| 1 | EthereumL1 | $46.1B | B+ | 16 | Regulatory risk — potential for future unfavorable classification by major regulators |
| 2 | LidoLiquid Staking | $18.7B | B | 24 | 28%+ of all staked ETH controlled by one protocol creates Ethereum-level systemic centralization risk |
| 3 | SSV NetworkLiquid Staking | $14.7B | B | 27 | DVT splits validator keys across 4+ operators via Shamir Secret Sharing — a compromised threshold (3-of-4) of operators could forge attestations or double-sign, risking slashing of the 7.4M+ ETH secured by SSV (~118,000 validators). |
| 4 | Aave V3Lending | $13.4B | C- | 51 | Accepted stolen rsETH as e-mode collateral on April 18, 2026 after Kelp DAO's LayerZero bridge was exploited for $292M; attacker borrowed WETH against now-worthless collateral, leaving Aave V3 with $177-200M in bad debt. WETH pool hit 100% utilization, $6.2B in withdrawals, AAVE -17.7%. Recovery plan: a DeFi United coalition (Consensys, Lido, EtherFi, others) pledged $300M+ and published a technical proposal on April 28 to restore full rsETH backing without socializing losses; governance votes across Ethereum and Arbitrum deployments are pending as of April 30. Umbrella holds ~23,500 WETH (~$54M), covering ~60% of L1 Core losses; outstanding deficit contingent on vote outcome. |
| 5 | WBTC (Wrapped Bitcoin)Bridge | $8.6B | C | 45 | Custodial dual-entity risk: WBTC relies on BitGo (now a federally OCC-chartered bank, NYSE-listed as BTGO since January 2026) and BiT Global (Justin Sun-affiliated, HK) as co-custodians holding ~118,000 BTC. While BitGo's federal charter significantly de-risks the primary custodian, a BiT Global insolvency, regulatory seizure, or governance dispute would impair the 1:1 backing. |
| 6 | EigenLayerRestaking | $8.6B | C+ | 36 | EigenLayer introduced restaking as a novel mechanism category where staked ETH simultaneously secures multiple Actively Validated Services (AVSs), creating correlated slashing risk — an operator slashed on one AVS could trigger cascading unstaking across other AVSs they secure, though the April 2025 slashing upgrade introduced unique allocated stake per AVS to contain blast radius. |
| 7 | MorphoLending | $7.5B | B- | 32 | P2P matching engine adds complexity: if matching fails, fallback to pool rates may surprise users |
| 8 | Binance Staked ETHLiquid Staking | $7.4B | B- | 33 | Centralized custody: all staked ETH is managed by Binance validators, creating a single-entity dependency for ~$7.7B in assets |
| 9 | EigenCloudRestaking | $6.3B | C+ | 41 | Protocol generates minimal organic revenue — the $541K/month ($6.5M/year) in real fees is dwarfed by ~$12M/year in EIGEN emissions; ELIP-012 (approved March 2026) routes real fees to buyback but net dilution continues as emissions exceed revenue |
| 10 | SolanaL1 | $6.2B | C+ | 39 | Network reliability — history of extended outages requiring validator coordination to restart |
| 11 | MakerDAOCDP | $5.7B | B- | 31 | Oracle-dependent liquidation system: Maker relies on a custom oracle module (Medianizer/OSM with 1-hour delay) feeding ETH and other collateral prices. During Black Thursday (March 2020), oracle lag combined with network congestion led to $8.3M in zero-bid liquidation auctions. The system has since been rebuilt with Liquidations 2.0 (Dutch auction format) and Chainlink integration, substantially mitigating but not eliminating oracle-related liquidation risk. |
| 12 | Sky LendingCDP | $5.7B | C- | 51 | Extremely thin capital buffer: S&P rated the protocol B- citing a 0.4% capital ratio — any significant bad-debt event could threaten solvency |
| 13 | SkyCDP | $5.7B | B- | 30 | USDS freeze function introduces censorship risk that undermines decentralization, splitting the community between DAI purists and USDS adopters |
| 14 | HyperliquidDerivatives | $5.2B | C- | 56 | Custom L1 with limited validator set creates centralization and censorship risk; team demonstrated unilateral intervention capability during the JELLY delisting |
| 15 | TronL1 | $5.1B | B- | 30 | Rainberry Inc. (Tron-associated) settled SEC charges for $10M in March 2026 with all claims dismissed with prejudice, removing the primary regulatory overhang. Justin Sun's ongoing wash-trading controversy and a May 2026 defamation lawsuit against WLFI (following Sun's fraud suit alleging governance manipulation over his $107M WLFI position) introduce fresh reputational and legal risk tied to the key person. |
| 16 | BNB ChainL1 | $5.0B | C+ | 40 | Centralization — only 21 cabinet validators produce blocks (45 total including candidates), all effectively controlled by Binance ecosystem |
| 17 | EthenaStablecoin | $4.3B | C | 49 | Reserve fund ($62M) covers ~1.4% of $4.4B USDe supply — depletes in ~52 days under the protocol's own V1 stress test at -10% annualized funding (coverage ratio thinned further as supply recovered from the $3.8B trough to a May 2026 high near $5.4B, only to contract again as funding rates compressed) |
| 18 | BabylonRestaking | $3.8B | C- | 57 | Self-custodial BTC staking via EOTS is a novel cryptographic primitive with no battle-tested precedent — any flaw in slashing/extraction logic could irreversibly forfeit staked BTC |
| 19 | Babylon ProtocolRestaking | $3.8B | C- | 53 | BLS vote extension vulnerability allows validators to bypass consensus by omitting block hash fields, undermining the security model at its core. |
| 20 | ether.fi Stake (eETH/weETH)Liquid Staking | $3.7B | C | 48 | EigenLayer restaking slashing (conditional risk): eETH validators are set up for EigenLayer restaking, but ether.fi operators have not yet opted into slashing modules per Chaos Labs' governance analysis. When/if operators opt in, all eETH holders would share proportional losses from any AVS slashing event — the architecture supports socialized loss even though the risk is not yet active. |