The back-to-back failures renewed scrutiny of DeFi’s underlying architecture and highlighted persistent vulnerabilities in protocol design and governance.
Decentralized finance (DeFi) industry suffered one of its toughest weeks in months as total value locked (TVL) across major networks fell sharply.
According to Sentora data, DeFi protocols on Ethereum, Solana, Arbitrum, BNB Smart Chain, and Base all recorded double-digit declines.
This reflected a broad pullback in user activity as market conditions shifted and security incidents intensified.
Additional data from DeFiLlama shows that Ethereum, the largest DeFi ecosystem, has seen its TVL drop by roughly 13% to approximately $74.2 billion. Despite the setback, Ethereum still controls over 62% of the sector.
Solana and Arbitrum experienced even sharper declines, each losing about 14% of their locked value. Their TVLs now stand at approximately $10 billion and $3 billion, respectively.
Solana, however, maintains its position as the second-largest DeFi chain, with more than 8% of the market share.
BNB Smart Chain and Base were not spared, shedding around 10% and 12% of their TVLs.
As these losses accumulated, total DeFi TVL slid from nearly $150 billion to $130 billion, signaling a marked slowdown in borrowing, lending, and staking activities across the ecosystem.
Meanwhile, security breaches exacerbated the TVL decline as a series of high-impact exploits rattled users and deepened an already weak market.
On November 3, Balancer — one of the industry’s longest-running DeFi platforms — suffered one of the largest exploits of the year. Attackers drained more than $120 million from its V2 vaults.
In a detailed explanation on X, the team linked the breach to a rounding error in the upscale function for EXACT_OUT swaps inside the vault’s batchSwap feature. The feature allows users to bundle multiple swaps in a single transaction to reduce gas costs.
“Attackers were able to exploit the incorrect rounding behavior in combination with the batchSwap functionality to manipulate pool balances and extract value. In many instances, the exploited funds remained within the Vault as internal balances before being withdrawn in subsequent transactions,” it stated.
Meanwhile, a second major disruption occurred shortly after when Stream Finance announced that approximately $93 million in assets managed by an external fund manager had gone missing.
In response, the protocol halted all withdrawals and deposits. It also stated that pending deposits would not be processed, and began pulling what remained of its liquid assets.
The fallout spread quickly as Elixir, a DeFi liquidity provider, said the incident forced it to wind down its deUSD synthetic dollar stablecoin.
Together, these events intensified scrutiny of DeFi’s underlying architecture.
The back-to-back failures underscored how sophisticated attackers can still exploit design flaws, governance gaps, and imperfect smart-contract logic. These incidents reinforced long-standing concerns about the sector’s structural vulnerabilities.
