HR20 Index

Risk ratings for the 20 largest protocols by total value locked.

HR20 Moversvs 2026-09-07

Entered

Dropped

Combined TVL

$172.4B

Avg Risk Score

37/100

A-B Grades

D-F Grades

#	Protocol	TVL	Grade	Score	Top Risk
1	EthereumL1	$37.7B	A-	13	Staking centralization — top entities including Lido (~25%) and major CEXs collectively control >60% of staked ETH; below the 33% single-entity censorship threshold but the concentration creates cartelization and correlated-failure risk
2	LidoLiquid Staking	$17.8B	B	24	~23% of all staked ETH controlled by one protocol creates Ethereum-level systemic centralization risk; market share has declined from a 2023 peak of ~32%, reducing proximity to the 33% consensus interference threshold
3	Aave V3Lending	$13.9B	C	49	Accepted stolen rsETH as e-mode collateral on April 18, 2026 after Kelp DAO's LayerZero bridge was exploited for $292M; attacker borrowed WETH against now-worthless collateral, leaving Aave V3 with $177-200M in bad debt. WETH pool hit 100% utilization, $6.2B in withdrawals, AAVE -17.7%. Recovery plan: a DeFi United coalition (Consensys, Lido, EtherFi, others) pledged $300M+ and published a technical proposal on April 28 to restore full rsETH backing without socializing losses; governance votes across Ethereum and Arbitrum deployments are pending as of April 30. Umbrella holds ~23,500 WETH (~$54M), covering ~60% of L1 Core losses; outstanding deficit contingent on vote outcome.
4	SSV NetworkLiquid Staking	$9.4B	B	27	DVT splits validator keys across 4+ operators via Shamir Secret Sharing — a compromised threshold (3-of-4) of operators could forge attestations or double-sign, risking slashing of the 7.4M+ ETH secured by SSV (~118,000 validators).
5	Morpho BlueLending	$7.8B	C	47	Oracle-agnostic permissionless markets: any oracle can be used in any market, including low-quality or malicious ones; the October 2024 PAXG exploit ($230K) confirmed oracle misconfiguration is the primary attack vector
6	MorphoLending	$7.6B	B-	30	P2P matching engine adds complexity: if matching fails, fallback to pool rates may surprise users
7	WBTC (Wrapped Bitcoin)Bridge	$7.4B	C	50	Custodial 2-of-3 key concentration in Justin Sun entities: BiT Global (Justin Sun-affiliated, HK) now holds two of the three keys in WBTC's custody vault arrangement — the user key (Hong Kong) and backup key (Singapore) — while BitGo retains one key and provides infrastructure. A BiT Global insolvency, regulatory seizure, or governance dispute could impair the 1:1 BTC backing on ~$7.4B of circulating WBTC. BitGo's OCC bank charter and Fortune 500 status (NYSE: BTGO) provide a strong institutional backstop on the BitGo side.
8	Binance Staked ETHLiquid Staking	$7.1B	B-	35	Centralized custody: all staked ETH is managed by Binance validators, creating a single-entity dependency for ~$7.4B in assets
9	LayerZeroBridge	$6.7B	C-	53	Infrastructure compromise confirmed: the April 2026 KelpDAO exploit ($292M) demonstrated that social engineering of LayerZero developers combined with DDoS-forced RPC failover can bypass DVN verification for single-verifier (1-of-1) applications. LayerZero admitted fault on May 9, 2026; $2B+ in TVL migrated to competing solutions.
10	SolanaL1	$6.2B	B-	35	Network reliability — history of extended outages requiring validator coordination to restart
11	MakerDAOCDP	$6.2B	B	26	Oracle-dependent liquidation system: Maker relies on a custom oracle module (Medianizer/OSM with 1-hour delay) feeding ETH and other collateral prices. During Black Thursday (March 2020), oracle lag combined with network congestion led to $8.3M in zero-bid liquidation auctions. The system has since been rebuilt with Liquidations 2.0 (Dutch auction format) and Chainlink integration, substantially mitigating but not eliminating oracle-related liquidation risk.
12	Sky LendingCDP	$5.7B	C-	53	Extremely thin capital buffer: S&P rated the protocol B- citing a 0.4% capital ratio — any significant bad-debt event could threaten solvency
13	SkyCDP	$5.7B	B-	30	USDS freeze function introduces censorship risk that undermines decentralization, splitting the community between DAI purists and USDS adopters
14	HyperliquidDerivatives	$5.2B	C-	55	CME Group and ICE formally lobbied CFTC (May 2026) to mandate Hyperliquid register as a derivatives exchange with KYC and trade surveillance; the platform was also used as a laundering passthrough in the May 2026 THORChain exploit, reinforcing the sanctions evasion narrative regulators have advanced
15	BNB ChainL1	$5.2B	C+	38	Centralization — only 21 cabinet validators produce blocks (45 total including candidates), all effectively controlled by Binance ecosystem
16	EigenLayerRestaking	$5.1B	B-	34	EigenLayer introduced restaking as a novel mechanism category where staked ETH simultaneously secures multiple Actively Validated Services (AVSs), creating correlated slashing risk — an operator slashed on one AVS could trigger cascading unstaking across other AVSs they secure, though the April 2025 slashing upgrade introduced unique allocated stake per AVS to contain blast radius.
17	TronL1	$5.1B	B	27	Rainberry Inc. (Tron-associated) settled SEC charges for $10M in March 2026 with all claims dismissed with prejudice, removing the primary regulatory overhang. Justin Sun's dual federal litigation — suing WLFI for fraud (alleging governance manipulation over his $107M position) while being counter-sued by WLFI for defamation and market manipulation — both cases active in U.S. federal court as of July 2026, introducing fresh reputational and legal risk tied to the key person.
18	EigenCloudRestaking	$5.1B	C+	40	Protocol generates minimal organic revenue — the $541K/month ($6.5M/year) in real fees is dwarfed by ~$12M/year in EIGEN emissions; ELIP-012 (approved March 2026) routes real fees to buyback but net dilution continues as emissions exceed revenue
19	EthenaStablecoin	$3.8B	C	47	Reserve fund ($62M) covers ~1.4% of $4.4B USDe supply — depletes in ~52 days under the protocol's own V1 stress test at -10% annualized funding (coverage ratio thinned further as supply recovered from the $3.8B trough to a May 2026 high near $5.4B, only to contract again as funding rates compressed)
20	SparkLendLending	$3.7B	B-	30	Sky ecosystem concentration: SparkLend is deeply coupled to MakerDAO/Sky governance and the USDS/DAI stablecoin. SparkLend's liquidity backbone (the Spark Liquidity Layer) is Sky-controlled — a governance crisis or DAI instability would directly impair SparkLend's lending capacity.

Ranked by TVL. Lower risk score = safer. Read our methodology →