Skip to content
PROTOCOL RESEARCH

Ethena risk

USDe gave back about 13% of TVL and $564M of supply this month to ordinary carry contraction rather than distress, holding its peg through the whole window, but sUSDe now pays 3.95% against a 4.49% Aave USDC borrow cost, the on-chain governance is weaker than Ethena's own docs claim on two counts (a 5-of-10 Safe where the docs say 7-of-10, and a 24-hour timelock where the docs say 7 days), and the backing composition is genuinely unmeasurable: Ethena's live documentation still states 90% perpetual futures while secondary reporting says 11%.
CautionResearched Aug 5, 2026

Scorecard

strong: Audits & contractsAll eight named firms verified on Ethena's own audits page as numbered phases (Zellic, Spearbit, Quantstamp, Cantina, Pashov, Code4rena, Cyfrin, Chaos Labs); no critical or high findings published; Immunefi bounty confirmed live since April 2024 with a $3M maximum. Cyfrin's scope was USDtb, not core USDe.
watch: Admin controlVerified on-chain: a 24-hour TimelockController owns the mint/redeem and staking contracts, and the Dev Safe reads 5-of-10. Both are weaker than Ethena's docs claim (7-of-10 confirmations, 7-day timelocks), and the docs name the Safe as owner rather than the timelock. Reserve fund 4-of-10 confirmed exactly as documented.
watch: OracleDowngraded from green. The attestation stack is real and named (LlamaRisk, HT Digital, Chainlink PoR, Chaos Labs, monthly custodian attestations), but no live attested figure was readable this run and the only composition Ethena publishes in its own docs is a January 2025 snapshot that contradicts current secondary reporting by 79 points.
watch: Liquidity & exitAbout $564M of net supply decline cleared with the peg intact and a same-week rebound, so the mechanism works. Composition is the problem: backing is moving into institutional loans and tokenized CLOs that do not redeem at par on demand, and the current split cannot be measured from public sources.
strong: Yield (real vs emission)Confirmed zero emission component (DeFiLlama reports apyReward null, all 3.949% is apyBase). Yield comes from funding, basis, staking, lending and RWA income, never an inflationary token. It has compressed below the 4.49% cost of borrowing USDC on Aave.
watch: Holder concentrationTop-wallet distribution still unobtainable (both Nansen and Etherscan holder endpoints are paywalled). Measured structurally instead: the sUSDe staking contract alone holds 40.1% of mainnet USDe supply, and supply moved 12.7% in a month.
strong: Track recordLive since March 2024. No depeg, custodian failure, counterparty event or exploit between 2026-07-01 and 2026-08-05, on top of surviving the Bybit scare and the October 2025 crash without user fund loss.
🟢 strong🟡 watch / caveat🔴 weak / fund-loss risk
Verdict is a gate (worst flaw wins), not an average. Our read, not financial advice.

Live facts

auto-sourced now
TVL$3.92B
30d↑1%
Audits2
Last hacknone

DeFiLlama + our exploits feed. Cross-check the dated report against today.

TL;DR

USDe is a synthetic dollar. The design holds it flat with a delta-neutral basis trade: spot collateral against short perpetuals, with the collateral parked at exchanges through off-exchange settlement custodians. This month it shrank, and it shrank gracefully. TVL fell from $4.827B to $4.201B, about 13%, and USDe supply fell from $4.447B to $3.883B, a net $564M. The peg held throughout, ranging $0.99817 to $1.00006 on daily closes, with no failed redemption and no incident. The reason holders left is arithmetic rather than fear: sUSDe pays 3.95% while borrowing USDC on Aave costs 4.49%, so the leverage loop that had become the main source of demand is roughly 55bp underwater and unwinding mechanically.

Two things are worth more attention than the outflow. First, what you actually underwrite here may be drifting away from exchange counterparty risk and toward credit risk, and nobody outside Ethena can currently measure how far. Ethena's own live documentation still describes the backing as 90% perpetual futures, split Binance 50%, Bybit 25%, OKX 15%, Deribit 5%, Bitget 5%. Secondary reporting from April 2026 says perpetuals are about 11%. Those cannot both be true. The transparency dashboard that would settle it renders client-side and its API returns 403.

Second, the governance is meaningfully different from what the documentation says. Reading the chain rather than the docs, the contracts that mint USDe and stake it are owned by a TimelockController with a 24-hour minimum delay, and the Safe that drives it clears at 5 of 10 signers. Ethena's security pages claim 7-of-10 confirmations and 7-day timelocks. The good news is that a timelock exists at all, which the previous two reports could not confirm. The bad news is that it is one seventh as long as advertised, and the disclosure overstates the protection on both axes.

Checklist

Audits & contracts. This holds up under direct checking. Ethena's audits page lists a numbered program: Zellic on v1, a Spearbit architecture review by Kurt Barry, then Quantstamp, Cantina, Pashov across multiple engagements, a public Code4rena contest, and an economic risk audit by Chaos Labs. Cyfrin appears too, though its engagement was on USDtb rather than the core USDe contracts, which is worth knowing if you are pricing USDe specifically. No critical or high findings are reported in the published reports and there has been no protocol-level smart-contract exploit of the core contracts to date. The Immunefi bounty deserves a correction in Ethena's favour: the docs still describe it as an upcoming Phase 7, but the program has been live since 4 April 2024 with a $3M maximum on critical smart-contract findings and 27 assets in scope. Nothing changed here this month. This remains the strongest part of the stack and also the least relevant, because the surfaces that actually threaten USDe are not code.

Admin control. This was a standing open item across two reports and it is now largely settled, on-chain, and the answer is mixed. Ethena publishes three mainnet multisigs under Key Addresses, and I read all three directly. The Reserve Fund Safe returns a threshold of 4 with 10 owners, matching the documented 4-of-10 exactly, which confirms the figure carried unverified since the first report. The sUSDe Payout Fund returns 3 of 10 against a documented 3-of-11. The Dev Safe returns 5 of 10 against a documented 5-of-11. So the owner counts are off by one in two places, and the thresholds themselves are accurate on that page.

The problem is a different page. Ethena's security documentation states that "each multisig requires 7/10 or more confirmations before transactions are approved" and that the DEFAULT_ADMIN_ROLE multisig "requires 7 signatures", and it links that claim directly to the Dev Safe address, the same address its own Key Addresses page describes as 5-of-11 and the chain reports as 5-of-10. Ethena's documentation therefore contradicts both the chain and itself. There is no separate 7-of-10 Safe hiding behind this: both pages point at the same address.

The timelock claim resolves better than expected. The docs assert 7-day timelocks over any change to core functions, and the page titled "Matrix of Multisig and Timelocks" contains no timelock column and no durations for any role, which is exactly the kind of gap that usually means the claim is empty. It is not empty. The on-chain owner of both the Mint and Redeem V2 contract and the sUSDe staking contract is a TimelockController whose minimum delay reads 86,400 seconds, which is 24 hours. That address appears nowhere in Ethena's documentation, which names the Dev Safe as owner instead. The Dev Safe holds proposer, executor and canceller roles on that timelock, so the real structure is a 5-of-10 Safe that proposes a change, waits a day, and executes it, and can cancel its own proposals. That is a genuine safeguard and a real improvement on "no timelock documented". It is also 24 hours, not 7 days, and you would not learn any of it from the documentation.

Carried from the prior run and not re-verified this month: sUSDe has a live freeze and seizure power, where a blacklist manager can flag an address FULL_RESTRICTED, blocking transfer, redemption and unstaking, after which the admin can burn the frozen balance and re-mint it elsewhere. The prior run recorded that admin path moving behind a 24-hour timelock on 20 July 2026, which is consistent with the 24-hour delay I measured on the staking contract's owner. USDe itself has no such function.

Oracle. Downgraded to yellow, and the reason is coverage rather than any failure. The attestation machinery is real and independently named: proof-of-reserves from LlamaRisk and HT Digital (Harris and Trotter), a Chainlink PoR feed, Chaos Labs as attestor, and monthly custodian attestations from Copper, CEFFU, Anchorage Digital and Kraken. None of that is in question. What I could not do is read a single live attested number. The transparency dashboard renders client-side and its API endpoints return 403, which I confirmed directly rather than inferring. Green on this dimension asserts that backing is verified; what I can honestly assert is that the apparatus for verifying it exists.

The forward-looking problem is sharper than a bad fetch. Proof-of-reserves is easy for a BTC balance at a custodian and hard for a private institutional loan book. As backing migrates toward lending and structured credit, the share of the book this stack can attest to on-chain shrinks. And the one composition figure Ethena publishes in its own documentation is a January 2025 snapshot presented in the present tense, stating 90% perpetual futures. If the April 2026 reporting of 11% is right, the official documentation is off by nearly eight times and fifteen months out of date. Either the docs are stale or the reporting is wrong, and a reader who does the responsible thing and consults the primary source gets the worse answer.

Liquidity & exit. Mint and redeem run 24/7 against provable backing, so exit does not depend on a thin secondary pool, and this month tested that. Supply fell $494M between 9 and 14 July, bottoming at $3.849B, then rebounded $163M on 15 July, and the peg never left a 19bp band. That is the shape of orderly redemption followed by stabilisation, not a run. It is worth correcting a tempting narrative here: the expansion announcements did not coincide with the outflow, they followed it. Kraken removed USDe mint and redeem fees on 14 July, the Monad launch with an Aave integration landed on 16 July, and Avalanche deposits and withdrawals opened on 17 July. The outflow ran 9 to 14 July and the rebound began on the 15th. The launches look like a response to the drawdown, or at least a coincidence with the recovery, not a cause of the drawdown.

Yellow rather than green is about composition, not mechanics. Ethena is moving backing into overcollateralized institutional lending with Anchorage Digital, Maple Institutional and Coinbase Asset Management, and into tokenized T-bills, CLOs, investment-grade corporate bond funds and short-duration structured credit. Its own docs say the protocol is "extending this exposure into high-liquidity real-world assets beyond treasury bills, including tokenised, liquid fixed income and credit instruments selected for low volatility, relatively strong liquidity and settlement terms, and their ability to be exited at predictable values". Those instruments are chosen for liquidity and that is the right design intent, but none of them settle at par on demand the way a stablecoin balance does. A synthetic dollar promising instant redemption while holding credit is running a maturity mismatch, however small and however well-chosen the credit. The current split is not publicly measurable, which is precisely why this cannot be graded green.

Yield: real vs emission. The yield is real, and this is now confirmed rather than asserted: DeFiLlama reports the sUSDe pool with a null reward APY and the entire 3.949% as base yield, so there is no emission component to strip out. It comes from short-perp funding, futures basis, staking rewards, and now lending and RWA income. On the dimension as named, unambiguously green.

The context is that the number has collapsed. sUSDe pays 3.949% today with a 30-day mean of 3.987%, against roughly 9.4% on a 7-day basis and 11.8% on a 90-day basis as recently as April 2026, and roughly 27% at launch. Borrowing USDC on Aave v3 Ethereum costs 4.495% against $1.98B of borrows. The loop is negative carry by about 55bp, and that single comparison explains this month's outflows better than any story about sentiment. Note what the compression implies about the book: 3.9% is roughly what a stablecoin and short-credit portfolio yields, not what a crowded basis trade yields, which is weak independent support for perpetuals now being a minority of backing. That is an inference from the yield, not a measurement of the book. Structurally, sUSDe absorbs no negative revenue directly; the reserve fund is designed to take it and rewards go to zero rather than negative.

Holder concentration. Still unresolved at the wallet level, and I want to be plain that this is a tooling limit rather than a judgement: both routes to a top-holder table, Nansen and Etherscan, are behind paywalls and returned 403 and a Pro-endpoint error respectively. The ~250k staker figure remains stale Q1 2026 secondary data. What I could measure directly is structural concentration, and it is substantial: of 3,900,452,713 USDe on Ethereum mainnet, the sUSDe staking contract holds 1,562,536,948, or 40.1%, and Aave's aEthUSDe holds a further 198.2M, or 5.1%. That is concentration by design rather than by whale, but it means two contracts are the counterparty to 45% of the float, and supply moving 12.7% in a month is itself a signal that a modest number of large, yield-sensitive positions dominate the marginal flow. Treat the holder base as concentrated in leveraged carry until someone shows otherwise.

Track record. Live since March 2024. The specific question this month was whether anything broke between 1 July and 5 August 2026, and the answer is no: no depeg, no custodian failure, no exchange counterparty event, no exploit. July was a month of expansion, including a Liquid Leverage integration on Aave on 29 July designed to work around the 7-day sUSDe unstaking window by holding a 50/50 USDe and sUSDe mix. The older record stands and should not be softened. USDe printed roughly $0.62 to $0.65 on Binance during the October 2025 crash, a venue-specific dislocation driven by Binance's self-referential margin oracle rather than a backing failure, while the token held near a dollar on Curve. Funding hit about -42% in that crash and supply went from about $9B to $6B without breaking backing. The Bybit scare in February 2025 produced the largest single redemption to that point, about $123M, which cleared. The September 2024 incident was a domain-registrar compromise of the frontend on 18 September; Ethena deactivated the site and confirmed no user funds were lost and the protocol was unaffected, which I re-verified this run. A separate March 2024 incident often filed under Ethena's name, a roughly $290k loss, was a counterfeit ENA token on BNB Chain and not an Ethena system at all. This is a meaningful stress record for a design this young. It still has not seen a long, deep, sustained negative-funding regime at large size, and it has never been tested with a credit sleeve in the backing.

Worst case

The realistic worst case has moved, and the buffer against it is thinner than the headline number suggests. It used to be a custodian or exchange failure while collateral sat there through off-exchange settlement, or a deep negative-funding regime outrunning the reserve fund. Both remain live. The new one is a redemption run against a book that has credit in it. Institutional loans and CLO tranches are liquid until the moment everyone wants out at once, which is exactly the moment USDe holders would be redeeming. Ethena selects these instruments for exit at predictable values and that is the right intent, but intent is not a bid. If a credit shock and a redemption wave arrive together, the protocol either sells credit into a falling market and takes a mark, or gates the exit, and either outcome breaks the par promise.

The shock absorber is smaller than the last report implied. Read directly, the Reserve Fund Safe that Ethena publishes holds $42.0M in USDtb today and nothing else of substance, with no DeFi positions at that address. The end-March 2026 governance post reported $62M, being $41.98M in USDtb plus a $20.02M USDtb/USDC LP position. The USDtb leg is intact and essentially flat; the LP leg is not at that address, and I could not establish where it is. So the verified buffer is 1.08% of current supply, and the $62M figure requires an LP position I cannot locate. Compounding this, Ethena's docs state that "the percentage of revenue allocated to the Reserve Fund is currently 0%, with 100% being directed to incentive rewards, promotional distributions, and distribution incentives". The buffer is not growing while the book takes on credit risk it did not carry when that buffer was sized.

The second failure mode is already observed and needs no imagination: a venue-level peg break like Binance in October 2025, where the token traded far below a dollar on one exchange while backing was intact, which still liquidates leveraged holders on that venue. Ethena has proposed an emergency stabilization mechanism using up to about 1.2% of backing to buy USDe at or below $0.99 and burn it. There is no external insurance beyond the reserve fund. Position sizing and not treating USDe as a cash equivalent remain the mitigations.

Bottom line

Caution, unchanged, and this month the case for it got more concrete rather than more speculative. The engineering is still excellent, the audit program is genuinely deep, and the redemption mechanism did its job under $564M of net outflow without the peg leaving a 19bp band. That is the behaviour you want to see from a shrinking protocol.

What keeps it off solid is that three of the things a holder would most want to check either cannot be checked or do not match the documentation. The backing composition cannot be measured at all, and Ethena's own docs give a figure that is either fifteen months stale or wrong by a factor of eight. The governance is real but weaker than advertised on two independent counts, and the address that actually holds power is not disclosed anywhere. The reserve fund verifiable on-chain is $42M, not $62M, and it is receiving none of the protocol's revenue. None of that is evidence of bad faith and none of it is a reason to panic; the protocol is behaving well and the disclosure is simply lagging what the chain says. But a report that told you the backing was verified and the timelock was seven days would be telling you something the sources do not support. Hold it as a yield position with counterparty, credit and funding risk, sized accordingly, and re-read the backing composition before increasing exposure.

Data appendix

  • TVL: $4.2008B (DeFiLlama, 2026-08-05, measured). The daily series puts 2026-07-01 at $4.8266B, so the month-over-month decline is 12.97%. Against the ~$4.80B the previous report printed, the decline reads 12.5%; both describe the same move at different precision. Weekly path: $4.824B (07-03), $4.523B (07-10), $4.254B (07-17), $4.217B (07-24), $4.105B (07-31). Sharpest run 10 to 14 July at -5.05%, -4.69%, -1.71%, +0.02%, -3.39%, followed by a +3.90% rebound on 15 July, then flat. No single-day cliff.
  • USDe supply: $3.8828B circulating (DeFiLlama stablecoin API, 2026-08-05, measured), down 12.69% from $4.4473B on 2026-07-01, a net decline of $564.4M. Within the window supply fell $494.4M from 9 to 14 July (to a $3.8495B low) and rebounded $162.5M on 15 July. Gross redemption volume is not derivable from net supply and is not reported here.
  • Peg: daily closes ranged $0.99817 (2026-07-01) to $1.00006 (2026-07-26), latest $0.99972 (CoinGecko daily, measured). Maximum deviation 18.3bp, well inside the 50bp depeg threshold, so no depeg in the window. These are daily-granularity closes; intraday extremes on individual venues are not captured.
  • sUSDe APY: 3.949% current, 3.987% 30-day mean, on $1.558B pool TVL, with reward APY null and the full yield as base (DeFiLlama yields, pool 66985a81-9c51-46ca-9977-42b4fe7bc6df, measured). Prior report: ~9.4% 7d and ~11.8% 90d as of April 2026.
  • Carry math: Aave v3 Ethereum USDC borrow APY 4.495% against $1.981B borrowed; USDT 3.609% against $2.504B; USDe 3.300% against $584M (DeFiLlama lendBorrow, measured). sUSDe minus USDC borrow is -54.6bp, so the sUSDe leverage loop is negative carry. This is the mechanical explanation for the month's outflows.
  • Concentration (measured): USDe mainnet totalSupply 3,900,452,713. The sUSDe staking contract (0x9d39a5de30e57443bff2a8307a4256c8797a3497) holds 1,562,536,948 USDe, 40.06% of mainnet supply, independently corroborating the $1.558B sUSDe pool TVL above. Aave's aEthUSDe holds 198,223,402 USDe, 5.08%. Top-wallet distribution beyond contract addresses: refresh (Nansen holders endpoint returns 403, Etherscan top-holders is a Pro endpoint).
  • Admin/governance (measured on-chain 2026-08-05, Ethereum mainnet): Dev Safe 0x3b0aaf6e6fcd4a7ceef8c92c32dfea9e64dc1862 returns getThreshold() = 5 with 10 owners; Ethena docs list it as "5/11 signers" and separately claim every multisig "requires 7/10 or more confirmations". sUSDe Payout Fund 0x71e4f98e8f20c88112489de3dded4489802a3a87 returns 3 of 10 against a documented 3-of-11. Reserve Fund 0x2b5ab59163a6e93b4486f6055d33ca4a115dd4d5 returns 4 of 10, matching the documented 4-of-10 and settling a figure carried unverified since the first report. owner() of both the Mint and Redeem V2 contract (0xe3490297a08d6fC8Da46Edb7B6142E4F461b62D3) and the sUSDe staking contract returns 0xe8dc0fab349ea169283c48ccfd09d797e6db7c94, a TimelockController whose getMinDelay() returns 86400 seconds, that is 24 hours, not the 7 days the docs assert. That address is not named anywhere in Ethena's documentation. The Dev Safe holds PROPOSER, EXECUTOR and CANCELLER roles on it (all three hasRole calls return true). The docs page titled "Matrix of Multisig and Timelocks" contains no timelock column and no durations for any role. Roles per docs: Owner multisig (transferOwnership, add/remove collateral assets, add/remove custodian addresses), Admin multisig (grant/revoke Minter, Redeemer, Gatekeeper), at least 3 gatekeeper EOAs internal and external (disable mint/redeem), 20 minter and 20 redeemer EOAs held by Ethena Labs.
  • Reserve fund (measured): the published Reserve Fund Safe holds 42,019,153 USDtb ($42.0M) plus dust, with no DeFi positions at that address, equal to 1.08% of current supply. The end-March 2026 governance post reported $62M, being $41.98M USDtb plus a $20.02M USDtb/USDC LP; the USDtb leg matches within 0.1% but the LP leg is not at this address and its current location is refresh. Ethena's docs state the share of protocol revenue allocated to the Reserve Fund "is currently 0%, with 100% being directed to incentive rewards, promotional distributions, and distribution incentives" (primary, measured from docs text).
  • Backing composition: refresh, and the primary and secondary sources conflict. Ethena's own docs state, in the present tense, "7% liquid cash, 3% deliverable futures, 90% perpetual futures", split Binance 50%, Bybit 25%, OKX 15%, Deribit 5%, Bitget 5%; adjacent pages date that snapshot to January 2025. Secondary reporting (Unchained, 2026-04-07) puts perpetual futures at roughly 11% with the remainder in stablecoin reserves and DeFi lending. Both cannot be current. The transparency dashboard renders client-side and its API endpoints return HTTP 403, confirmed directly this run. Direction of travel is corroborated by Ethena's docs, which state the protocol is "extending this exposure into high-liquidity real-world assets beyond treasury bills, including tokenised, liquid fixed income and credit instruments". Institutional lending with Anchorage Digital, Maple Institutional and Coinbase Asset Management is announced and in progress, not confirmed deployed.
  • Tokenized credit allocations: $250M to Centrifuge's Janus Henderson Anemoy AAA CLO fund (JAAA) and $250M to Securitize's tokenized AAA CLO fund (STAC) on Solana, announced 2026-06-12, for $500M of announced commitments (secondary: The Block, Crypto Briefing, PR Newswire). Deployment status is unconfirmed and at least partly cannot be complete: STAC held $102M AUM as of June 2026, well under Ethena's $250M commitment. Reporting describes STAC as supporting both USDe and USDtb without splitting it. Any percentage-of-backing figure derived from these commitments would be arithmetic on announcements, not a measured allocation, so none is given.
  • Audits: Zellic (Phase 1, v1), Spearbit (Phase 2, architecture review by Kurt Barry), Quantstamp, Cantina, Pashov (Phase 4, multiple engagements including V2 and sENA), Code4rena (Phase 5, public contest), Chaos Labs (Phase 6, economic and financial risk). All verified on Ethena's own audits page; no invented firms. Cyfrin is also named but its audit was on USDtb (31 Oct 2024), not the core USDe contracts. No critical or high findings in the published reports. Immunefi bounty verified live since 2024-04-04, maximum $3M on critical smart-contract findings, 27 assets in scope; Ethena's docs still describe it as an "upcoming" Phase 7, which is stale.
  • Custody / counterparty: off-exchange settlement via Copper, CEFFU, Anchorage Digital and Kraken, with monthly signed attestations published back to at least January 2026 (Ethena transparency dashboard, secondary this run).
  • Oracle / proof-of-reserves: independent PoR by LlamaRisk and HT Digital (Harris and Trotter), a Chainlink PoR feed, and Chaos Labs as attestor. Live attested values and current backing ratio: refresh (dashboard client-rendered, API 403, verified directly).
  • Recent-news / incident scan (2026-07-01 to 2026-08-05): no depeg, custodian failure, exchange counterparty event or exploit found. July was expansion, and it followed rather than accompanied the outflow: Kraken removed USDe mint and redeem fees on 14 July, Ethena launched on Monad with an Aave integration on 16 July, Avalanche deposits and withdrawals opened on 17 July, and Liquid Leverage launched on Aave on 29 July. ENA unlocks: roughly 40.6M foundation tokens in early August, plus a larger 171.88M unlock on 5 August (93.75M core contributors, 78.13M investors) that the prior draft omitted; both are ENA governance-token events, not USDe events. Prior record unchanged: October 2025 Binance print of roughly $0.62 to $0.65 with funding near -42% and supply falling from about $9B to $6B without breaking backing; February 2025 Bybit scare cleared a then-record ~$123M redemption; 18 September 2024 domain-registrar compromise of the frontend with no user fund loss and the protocol unaffected (re-verified this run). The roughly $290k loss sometimes attributed to Ethena was a counterfeit ENA token on BNB Chain in March 2024, not an Ethena system. Maintained monthly. Methodology: DeFi Research Instruction v2.

← all protocols