What's Covered: October 2026

What's Covered is our monthly read on the Nexus Mutual book:

• What's been listed?

• What are members buying?

• Where does DeFi yield sit?

• How much was lost?

• What does it mean for onchain risk?

New Protocols Covered

Origin WETH ARM and Ethena sUSDe ARM (Vault Cover)

Origin's Automated Redemption Manager (ARM) vaults buy a redeemable token below par and redeem it at par through the issuer's queue, keeping the spread. The WETH ARM does this with stETH, wstETH, eETH and weETH and parks idle WETH on Morpho; the sUSDe ARM buys discounted sUSDe, unstakes it through Ethena and parks idle USDe on Aave V3.

Both are OpenCover Covered Vaults, so a depositor who stakes their ARM shares in the matching covered vault stays covered for as long as they stay in it, with the premium streamed from the vault's yield.

Explore Covered Vaults on OpenCover.

Most Popular Products

Within Protocol Cover, eight protocols account for 90% of the $31 million in active cover.

Members bought $65.3 million of cover across 190 purchases, up from $60.1 million in September. The largest purchases included $5.6 million of looped positions on Kamino and Morpho, $2.8 million of Custody Cover on Crypto.com and $2.1 million in the Real World Insurance Vault's Baseline Yield Cover. Aave V3 saw the broadest demand, and a quarter of the month's purchases were through OpenCover Covered Vaults.

DeFi Yield Trends

Stablecoin yields firmed through October as demand to borrow them climbed. On a seven-day average, USDC on Aave's Ethereum market went from 3.3% at the start of September to 4.2% by the end of October. Base led the way, with Aave's USDC market there climbing from 3.5% to 6.7% in the last three days of the month after the Binance breach. Sky raised its Savings Rate from 3.60% to 3.80% and Maple's Syrup USDC held between 5.0% and 5.25%. Compound's USDC market was the exception, down from 5.5% at the start of September to 4.3% at the end of October.

The demand side saw solid growth. Borrowing against cbBTC in Morpho's cbBTC/USDC market on Base passed a record $1.6 billion outstanding, with $3.26 billion of cbBTC pledged at an aggregate loan-to-value of 49% and a variable rate of 5.25%. The cbBTC pledged there has nearly doubled since January. Aave V4's Equities Hub held $9.6 million of tokenized Magnificent 7 shares as collateral by mid-month with $4.08 million of USDC borrowed against them, and the number of borrowing wallets went from 8 to 144 in three weeks.

Total DeFi TVL was $88 billion on October 26, down from $114 billion at the start of the year, with Lido losing $790 million in a week while Morpho's vaults gained $304 million to reach $11.4 billion.

October's Losses

October saw $6.5 billion lost to exploits and operational security failures across 50 incidents, with a record $6.36 billion coming from Binance. TraderTraitor, the North Korean state-sponsored group, stole funds from 23 of Binance's hot wallets on 10 chains. The attacker had access to Binance's hot-wallet signing system, so every transfer carried a valid Binance signature. Binance traced the breach to a compromised DevOps engineer's laptop and later found additional points of breach, but no evidence that wallet private keys leaked.

Issuers and Arbitrum's Security Council have since frozen or seized $2.84 billion. Binance says the full loss will be absorbed from its Secure Asset Fund for Users (SAFU) and company funds, and withdrawals are now resuming in phases. Nexus Mutual's incident report has the chronology and the controls that should have been in place.

The other 49 incidents add up to $192 million, led by the $102 million taken from 324 wallets whose Ledger devices had been tampered with, sold through the reseller CryptoBilis. CoinDCX lost $16 million of USDT from retired deposit wallets on TRON. A compromised operator key drained $12.5 million from 79thVault's pool on BNB Chain; the attacker returned 15,000 BNB ($11 million), leaving a net loss of $2.7 million. A flash-loan governance takeover took $4.85 million from X100 Global, and Gamdom lost $4.2 million after an operational security failure. NEAR Intents also saw $3.9 million of USDT drained from an Omni vault, and the attacker returned the stolen funds the next day.

Polymarket traders lost $2.7 million when a hijacked third-party script on the site used their own signed-in sessions to sell or move their positions, with all 726 wallets being refunded. b14g gave up 97 million CORE ($1.47M) to withdrawal requests for zero tokens. A USDC lending vault on Avalanche was emptied of $1.01 million, and zkLink Nova's bridge lost $783,100 to a fake record of withdrawals. A retired contract drained $667,000 from a Troves vault on Starknet. Predict.fun put unauthorized transfers from traders' wallets at 400,000 USDT, and a registrar-level DNS hijack pointed 12 DeFi front ends at a wallet drainer for $202,386.

For the detailed roundup for any of these incidents, head over to the Nexus Mutual blog.

What It Means for Onchain Risk

Put thin lending spreads and higher borrowing together and you get low carry on growing leverage. Since supply rates only rose as borrowing did, a looper's funding cost rose with their yield. When a looped position only earns a percentage point or two more than it costs to borrow, losses can be realized when liquidations unrelated to normal market movements occur. A collateral depeg, stale oracle or oracle manipulation will do it, and those are the triggers Leveraged Liquidation Cover is written for, including on Morpho, Aave and Kamino.

Tokenized equities as collateral are another one to watch. Stocks don't trade on weekends and onchain markets do; that gap could be an oracle problem waiting for a bad market open on Monday. Curated vaults are the other line to follow, since depositors price them on headline APY and curators on fees, and Vault Cover is how either side stops relying on the other's judgment.

All of this is on top of the growing pace and record scale of crypto hacks. Centralized exchanges have become a favorite target for hackers, making Custody Cover more important than ever.

You're Covered with Nexus Mutual

Have questions about securing your crypto? Contact us.