TL;DR
Pendle splits a yield-bearing asset into PT (principal, redeems at par at maturity) and YT (the yield stream). The August report verified on-chain that PT-kHYPE and its HyperEVM market are immutable and ownerless, and this run confirms that again. This run also looked one contract further down, and found what neither prior report checked.
The SY adapter underneath, SY Kinetiq Staked HYPE at 0x57fc55dff8ceca86ee94a6bf255af2f0ed90eb9e, holds 393,262.4575 kHYPE. That number is exactly equal, to the token, to the SY's own total supply, which means it is the entire principal backing every PT, YT and LP unit in the market, about $37.5M. It is a transparent upgradeable proxy. Its EIP-1967 admin slot points at ProxyAdmin 0xa28c08f165116587d4f3e708743b4dee155c5e64, that ProxyAdmin answers owner() with the HyperEVM governance Safe, and that Safe is 3 of 5 with zero modules, an empty guard and no schedule, queue or delay function anywhere in the path behind it. Three signatures can replace the code of the contract holding the money, in one transaction, with no window in which to leave.
A second thing surfaced while chasing that path, and it is smaller but sharper. The governance proxy's pause(address[]) carries an onlyGuardian modifier in its verified source, which admits either DEFAULT_ADMIN_ROLE or the GUARDIAN role. On both Ethereum and HyperEVM, GUARDIAN is held by 0xeEa6f790F18563e91b18Df00b89d9F79B2E6761F, an address with zero bytes of code on both chains. It is a single key, not a multisig. The SY implementation exposes pause(), unpause() and paused(), and the SY's owner() is that governance proxy. So one private key, acting alone, can freeze the contract this hedge has to exit through.
Nothing about Pendle got worse this month. TVL is $1.277B, up about 7% since 5 August. There is still no protocol-level exploit. The Safe carries the same five signers at the same threshold. What changed is that the premise last month's solid rested on, that the contracts holding this portfolio's money cannot be changed, turned out to be half true, and the false half is the half with the assets in it. The verdict drops to caution.
Checklist
Audits & contracts. The core is genuinely well covered, and it was re-verified against Pendle's own repo rather than a marketing page. The audits tree now holds seven component directories containing twenty-three PDF files. main codebase carries eight firms across fourteen of them: Spearbit-2024, ChainSecurity-2024, Dedaub, Ackee, Dingbats, WatchPug, 0xleastwood and CMichel. Every firm named in the June report (Spearbit, ChainSecurity, Dedaub, Ackee) was checked to exist there, and so was every firm named since. ChainSecurity's Pendle V2 Core assessment, dated 15 August 2024, reports zero critical and zero high findings, two mediums both corrected, and nine lows. PtLooping (WatchPug) is new since the August report, which recorded six directories. LpPtoracle and LinearDiscountOracle, left unenumerated in August, hold two and one WatchPug reports respectively. A Cantina bounty pays up to $1,000,000 for critical findings, a figure carried from August and not re-read this run.
The downgrade to yellow is about one gap, and it is the gap that matters here. ChainSecurity's executive summary says plainly that "the security of SYs is highly dependent on the more derived implementation which was out of scope" and that "the scope only includes the base SY implementation, PY V1 and markets V1." Its exclusions section adds that the audit assumes "honest contract owners" and takes "the more derived contracts to be fully correct." The kHYPE SY is exactly such a derived implementation, and no folder in Pendle's audit tree is specific to SY adapters. The same report's informational finding CS-PENDLEOCT2023-024 notes that Pendle reserves upgradeable storage slots even though, in its words, "SY contracts will not be upgradeable." On HyperEVM in September 2026 that sentence does not describe the deployment. No flaw is alleged. What is missing is coverage of the specific contract with the money in it.
Admin control. The top-level governance picture is unchanged from August and was re-read line by line. Ethereum governance 0x8119EC16F0573B7dAc7C0CB94EB504FB32456ee1 is a Safe v1.4.1, getThreshold() 3, getOwners() five addresses, getModulesPaginated empty, guard slot zero, nonce 809. The HyperEVM Safe 0x7877AdFaDEd756f3248a0EBfe8Ac2E2eF87b75Ac returns the same version, the same threshold and the identical five owner addresses, with nonce 21. The governance proxy 0x2aD631F72fB16d91c4953A7f4260A97C2fE2f31e exists at the same address on both chains, both pointing at implementation 0x53c26f7645500fea9a856bfa09e820dacf643ab9, whose full ABI offers aggregate, aggregateWithScopedAccess, pause(address[]), role management and upgradeTo, and contains no schedule, queue, delay or eta function. hasRole(DEFAULT_ADMIN_ROLE, safe) is true on each chain for that chain's own Safe. No timelock has been added since 5 August.
What is new is where that power reaches. Last month this dimension was yellow because the reach was believed to stop at peripheral modules while the money sat in immutable contracts. It does not stop there. The SY holding the kHYPE is administered by the ProxyAdmin above, owner() on the SY itself returns the governance proxy, and the vkHYPE market's SY sits under the identical ProxyAdmin, so this is Pendle's standard HyperEVM architecture rather than a kHYPE anomaly.
The guardian finding is the part worth reading twice. The verified source of PendleGovernanceProxy gates pausing as require(hasRole(GUARDIAN, msg.sender) || hasRole(DEFAULT_ADMIN_ROLE, msg.sender)). Direct calls on both chains return true for hasRole(GUARDIAN, 0xeEa6f790F18563e91b18Df00b89d9F79B2E6761F), and eth_getCode on that address returns nothing on either chain. The same address received 200,000 PENDLE from the governance Safe in June and, on 5 September, was granted selector-admin authority over one selector on the Ethereum instance. Every other address tested, the two Safes and the dev multisig included, returns false for GUARDIAN.
The 5 September grant is now identified rather than guessed. The Safe called modifySelectorAdmin(address,bytes4[],bool[]) on the governance proxy, and the selector granted, 0x2a5c5816, is collectUnderlyingYield(), confirmed by computing the hash locally rather than trusting a signature directory. Per the contract's own comments, a selector admin can grant scoped access to that one selector, to any caller against any target. That is routine yield-collection plumbing, not a custody function, and saying so is part of reading the evidence honestly. What it does show is a live habit of handing operational authority to single keys.
One carry-over closes. The dev multisig 0xE6F0489ED91dc27f40f9dbe8f81fccbFC16b9cb1, flagged unresolved in August, holds neither DEFAULT_ADMIN_ROLE nor GUARDIAN on the governance proxy on either chain. Its own configuration has also changed since August: it is now 3 of 6, not the 2 of 5 recorded last month, and it shares one signer with governance, not two.
The Safe is not dormant. Six of the ten most recent transactions on the Ethereum Safe fall between 9 August and 13 September: three batched multiSend governance actions in August, and the 5 September selector grant. Three of those ten are PENDLE transfers out of the Safe, 400,000 on 20 July and 500,000 on 13 September to signer 0x7bd45693..., and 600,000 on 8 September to an unlabelled codeless address. That is about $4.1M of token moved with three signatures and no notice period. None of it looks irregular. All of it demonstrates that the instant-execution path is ordinary operating procedure, not an emergency door.
Oracle. Unchanged and still clean. Pendle prices PT and LP through its own TWAP oracle deployed as pyYtLpOracle at 0x5542be50420E88dd7D5B4a3D488FA6ED82F6DAc2, and 2,999 bytes of code were confirmed at that address on HyperEVM this run. No external price feed is consumed in the core path. August's withdrawal of the old Chainlink claim stands: Pendle ships a PendleChainlinkOracleFactory that wraps its own oracle for integrators, which is an adapter Pendle exports rather than a feed Pendle depends on. Redemption at maturity does not read the oracle at all, so the showcase position never touches it.
Liquidity & exit. Better than last month on every measure. A fresh quote sized to the real position, selling all 69.275 PT, returns about 68.1 units at 0.0008% price impact, four cents of swap fee, 0.1% of the pool, and the endpoint flags it safe to execute. Market liquidity read between $6,235,183 and $6,286,311 across two pulls twenty minutes apart, roughly double August's $3.22M. Twenty-four-hour volume is $2,878,354 against $102,038 in August. Pendle's HyperEVM footprint grew from $23.1M to $42.2M and now runs seven active markets, up from five. Maturity is 24 September, five days out, and PT redeems at par then regardless of secondary depth.
One qualification on that last phrase, and this run turned it from an argument into a measurement. The exit quote's output token is not kHYPE, it is the SY. PT redeems into SY, and turning SY back into kHYPE runs through the same contract discussed above. "Redeems at par no matter what" is a claim about the AMM, not about the whole path.
Yield: real vs emission. The market prints 2.83% implied against 2.00% underlying kHYPE yield. The fixed leg is real, funded by Kinetiq's staking yield as the discount to par, not by PENDLE emissions. The incentive layer exists and is tiny: pendleApy is 0.094 percentage points inside an aggregated 2.23%, with a 2.37% maximum boost. With five days left the PT discount has compressed to 0.033%, which is what a nearly matured principal token should look like. There is almost no fixed yield left to collect here. This leg is in the portfolio to hedge a HYPE short, and the strategy's return comes from funding, not from this.
Holder concentration. Measured at last, after two reports in a row marked it unobtainable. Nansen and Etherscan top-holder endpoints are both still Pro-gated, so the distribution came from Ethplorer and was cross-checked against direct balanceOf calls on Ethereum, which agreed to the token on every entry checked. The largest holder is the deprecated vePENDLE contract at 63,593,454 PENDLE, 22.59% of supply. Second is sPENDLE at 35,269,860, 12.53%. Eight months after the January migration, more PENDLE still sits in the retired locker than in the replacement. Third is the governance Safe itself at 19,751,622, 7.02%. Fourth, at 6.67%, is 0xf977814e...acec, an address long published as a Binance hot wallet, though that label was not verified this run. Then two contracts at 5.73% and 5.18%, both confirmed to carry code but neither identified, and the largest unlabelled EOA at 4.01%. The top five hold about 54.5% and the top twelve about 72%. Concentrated, but two of the top three are protocol contracts rather than owners, and none of it touches PT principal.
Track record. The clean record holds. DeFiLlama's hacks list was pulled and searched again: 1,273 entries, and no entry names Pendle. The single adjacent entry remains Penpie, dated 3 September 2024, $27,000,000, classification Reentrancy, filed under parent magpie-ecosystem. Penpie was built on top of Pendle and used a malicious market created through Pendle's permissionless listing path. Pendle's own contracts were not breached; per the August report's reading of the post-mortem, the team paused every contract and resumed about seven hours later with roughly $105M reported safeguarded. An X scan of Pendle's own account from 1 August to 19 September returned no security incident, no pause and no governance change. The SY is not paused right now: paused() returns false.
Worst case
Three of five signers, compromised or coerced, call upgrade on the ProxyAdmin and point the SY at code of their choosing. The 393,262 kHYPE sitting in that contract is reachable by whatever the new implementation says it is. The PT token and the AMM are still immutable and still ownerless, and that no longer helps, because what they are immutably entitled to is SY, and SY is whatever the SY contract has been rewritten to be. There is no timelock, so there is no interval in which a holder sees the transaction and exits ahead of it. There is no insurance fund. Position sizing is the only mitigation that exists, plus the fact that this particular position matures in five days.
The softer version is more likely, costs money too, and now needs only one key rather than three. A single GUARDIAN holder can pause, as the 2024 response demonstrated the protocol can. For the showcase that means the HYPE short on Pacifica keeps repricing while the PT-kHYPE hedge is frozen and unsellable, leaving the short effectively unhedged for the duration, and a pause that outlasts 24 September blocks the redemption too.
The standing second surface is unchanged. On-chain PT/YT market creation is permissionless and has been for years, which is the path Penpie's attacker used. A malicious market cannot reach an existing one, but it can damage integrators, and a repeat would likely trigger another protocol-wide pause.
Bottom line
Caution, and the downgrade is a correction to our own diligence rather than a reaction to anything Pendle did. Two reports asserted that this position's money sat in contracts nobody could change. Two of the three contracts in that path qualify. The third, the one actually holding the kHYPE, is upgradeable by three signatures with no delay and freezable by one, and it almost certainly always was. We just never looked below the PT.
The case for leaving it at solid is real and worth stating rather than hiding. Every Pendle SY works this way, on every chain. Pendle has run for several cycles without a protocol-level exploit, the multisig's one famous use of emergency power was defensive, and if upgradeable custody under a competent team multisig is a red, then a large share of DeFi is permanently caution. That may simply be true. Caution in this series means size it and watch it, not avoid it, and "five people can re-code the contract holding your principal, and one person can freeze it, today, with no warning" is an accurate description of what you are accepting.
For the showcase specifically the practical exposure is small: about $6,440, five days to maturity, and an exit that costs less than a basis point if we want out sooner. The gate is about the surface, not the size. What would move this back to solid is narrow and checkable: a timelock in front of the ProxyAdmin, a renounced proxy admin on the SY, the GUARDIAN role moved from a single key to a multisig, or evidence that the redemption path does not depend on that contract the way the balances say it does.
Data appendix
- TVL: $1,276,986,822 (DeFiLlama parent slug
pendle, 2026-09-19) = childpendle-v2$1,269,415,520 plusboros$7,571,302, which sum to the parent exactly. Up 7.1% from the $1,192,646,311 the 2026-08-05 report recorded. Note the quiet revision: DeFiLlama's series now prints $1,201,950,690 for that same 5 August date, against which the move is 6.2%. Up 28.4% from $994,203,774 ninety days ago on 2026-06-22, and at 9.54% of the $13,390,777,660 ATH set 2025-09-19 (the August report recorded that ATH as $13,386,295,280; same revision effect). Source: api.llama.fi/tvl/pendle, /tvl/pendle-v2, /tvl/boros, /protocol/pendle. - TVL by chain: Ethereum $724.1M, Monad $207.0M, Arbitrum $155.2M, X Layer $68.8M, Plasma $65.2M, Hyperliquid L1 $42.2M, BSC $7.8M, Base $4.1M, Sonic $0.63M, Robinhood Chain $0.56M, then Avalanche, Mantle and Berachain under $50k each. Source: DeFiLlama
currentChainTvls. - Chain moves since 2026-08-05: Plasma down 60% from $163.3M, BSC down 60% from $19.6M, Monad up 34% from $154.8M, Arbitrum up 19% from $130.3M, Ethereum up 4% from $696.8M, Hyperliquid L1 up 83% from $23.1M, X Layer new at $68.8M, Robinhood Chain new at $0.56M. Source: DeFiLlama, August report.
- Audits: seven component directories, twenty-three PDF files.
main codebaseholds eight firms across fourteen PDFs (Spearbit-2024, ChainSecurity-2024, Dedaub, Ackee, Dingbats, WatchPug with four, 0xleastwood with two, CMichel with two);sPendle(WatchPug);marketV6(HickupHH3, WatchPug);marketV7(HickupHH3, WatchPug);LpPtoracle(WatchPug-LpOracle, WatchPug-PtOracle);LinearDiscountOracle(WatchPug-SparkLinearDiscountOracle);PtLooping(WatchPug, new since August). Source: github.com/pendle-finance/pendle-core-v2-public/tree/main/audits, tree API. - Audit scope, read this run: ChainSecurity, Pendle V2 Core, 15 August 2024. Zero critical, zero high, two medium (both corrected), nine low. Executive summary: "the security of SYs is highly dependent on the more derived implementation which was out of scope. Further, note that the scope only includes the base SY implementation, PY V1 and markets V1." Exclusions: "we exclude all the external systems, assume standard ERC-20 tokens, expect honest contract owners, and assume the more derived contracts to be fully correct." Finding CS-PENDLEOCT2023-024: "for example, SY contracts will not be upgradeable." Note 8.1: "LP providers should be aware that the reserve fee could be 100%, leading to no trading fees accrued for the LP providers." Source: reports.chainsecurity.com/Pendle/ChainSecurity_Pendle_PendleV2Core_Audit.pdf.
- Bug bounty: up to $1,000,000 for critical, Cantina-triaged. Carried from 2026-08-05, not re-read: refresh.
- Custody path, verified on-chain 2026-09-19 (HyperEVM): PT
0x50fc4edc6346f36993bb30fe60e932504ed17391and market0xb48b0c95b2ddc464484305b7363fad5bd5b7a683both return0x0at the EIP-1967 implementation and admin slots and revert onowner(). SY0x57fc55dff8ceca86ee94a6bf255af2f0ed90eb9e,name()= "SY Kinetiq Staked HYPE", implementation slot0x4f30a9d41b80ecc5b94306ab4364951ae3170210(13,952 bytes of code), admin slot0xa28c08f165116587d4f3e708743b4dee155c5e64,owner()= governance proxy0x2ad631f72fb16d91c4953a7f4260a97c2fe2f31e,paused()= false,exchangeRate()= 1.02500. ProxyAdmin0xa28c08f1...5e64is an OpenZeppelin v4 ProxyAdmin (bytecode containsupgrade,upgradeAndCall,changeProxyAdmin,transferOwnership,owner) andowner()= HyperEVM governance Safe0x7877AdFaDEd756f3248a0EBfe8Ac2E2eF87b75Ac. The vkHYPE market's SY0x457904b54f47dd7a91253f225237a5b02ca059d6carries the same admin slot, so the pattern is protocol-standard on this chain. Coincidence worth flagging so it does not read as a typo: the SY implementation address is byte-identical to the deprecated vePENDLE address on Ethereum, but they are different contracts on different chains (13,952 bytes on HyperEVM against 13,144 on Ethereum). - Custody balances, verified on-chain 2026-09-19:
kHYPE.balanceOf(SY)= 393,262.4575 andSY.totalSupply()= 393,262.4575, identical to the token, about $37.5M at the SY's $95.32. The YT contract0xe45162d03e0475dab556ef1cccefeea2ec27ade2holds 320,061.64 SY against 327,740.37 PT outstanding; the market holds 56,038.91 SY, matching the API'stotalSy. - Admin, verified on-chain 2026-09-19 (Ethereum): governance
0x8119EC16F0573B7dAc7C0CB94EB504FB32456ee1,VERSION()= 1.4.1,getThreshold()= 3, five owners (0x231fc5b0...,0x7bd45693...,0x9ce6de7e...,0x38ab4a7d...,0xf5173647...),getModulesPaginatedempty, guard slot zero, Safe nonce 809. Governance proxy implementation unchanged at0x53c26f7645500fea9a856bfa09e820dacf643ab9; ABI re-read and still contains no schedule, queue, delay or eta function;hasRole(DEFAULT_ADMIN_ROLE, safe)= true. - Admin, verified on-chain 2026-09-19 (HyperEVM): governance
0x7877AdFaDEd756f3248a0EBfe8Ac2E2eF87b75Ac,VERSION()= 1.4.1, threshold 3, the same five owner addresses as Ethereum, zero modules, empty guard, Safe nonce 21. The governance proxy exists at the same address on this chain (225 bytes, ERC1967) over the same implementation, andhasRole(DEFAULT_ADMIN_ROLE, HyperEVM Safe)= true while the Ethereum Safe returns false here. - Guardian, verified on-chain 2026-09-19 (both chains):
GUARDIAN()=0x8b5b16d04624687fcf0d0228f19993c9157c1ed07b41d8d430fd9100eb099fe8, matching a locally computedkeccak256("GUARDIAN").hasRole(GUARDIAN, 0xeEa6f790F18563e91b18Df00b89d9F79B2E6761F)= true on Ethereum and on HyperEVM;eth_getCodeon that address returns zero bytes on both, and it has sent 2,451 Ethereum transactions. The same call returns false for the Ethereum Safe, the HyperEVM Safe, the dev multisig and a control address. Verified source ofPendleGovernanceProxy:function pause(address[] calldata addrs) external onlyGuardian, withmodifier onlyGuardian() { require(hasRole(GUARDIAN, msg.sender) || hasRole(DEFAULT_ADMIN_ROLE, msg.sender), "PGP: n/a"); }. The SY implementation bytecode containspause(),unpause()andpaused(). Source: etherscan getContractSourceCode for0x53c26f76..., directeth_call. - Dev multisig, re-read 2026-09-19:
0xE6F0489ED91dc27f40f9dbe8f81fccbFC16b9cb1is now 3 of 6, not the 2 of 5 the August report recorded, and shares one signer with governance (0x231fc5b0...), not two. It holds neitherDEFAULT_ADMIN_ROLEnorGUARDIANon the governance proxy on either chain. Whether it holds scoped access on a specific selector and target pair is refresh. - Governance activity, ten most recent Ethereum Safe transactions, inner calls decoded: 2026-09-13 PENDLE
transfer500,000 to signer0x7bd45693...; 2026-09-08 PENDLEtransfer600,000 to0x99f5a734...(no code); 2026-09-05modifySelectorAdmin(address,bytes4[],bool[])on the governance proxy granting selector0x2a5c5816to0xeEa6f790...withisAdmins = [true], andisSelectorAdminOfnow returns true for that pair on Ethereum and false on HyperEVM; 2026-08-26, 2026-08-25 and 2026-08-09 batchedmultiSendcalls; 2026-07-20 PENDLEtransfer400,000 to0x7bd45693...; 2026-07-09changeProxyAdminon0xa28c08f1...; 2026-06-12 PENDLEtransfer200,000 to0xeEa6f790...; 2026-06-08 a failedmultiSend. No pause among them. Safe nonce is 809, so this is the recent tail, not the full history. Selector0x2a5c5816resolves tocollectUnderlyingYield(), confirmed by local keccak and corroborated by the OpenChain signature database. Source: EtherscannormalTxsByAddress. - Oracle: Pendle in-house PT/LP TWAP,
pyYtLpOracle0x5542be50420E88dd7D5B4a3D488FA6ED82F6DAc2, 2,999 bytes of code confirmed on HyperEVM this run. No external price feed in the core path. Recommended window 900s or 1800s; market oracles are not initialized by default, which is a risk for lending protocols taking PT as collateral, not for a holder redeeming at maturity. - Owned position (this run): 69.275 PT-kHYPE-24SEP2026, the size recorded in migration 076 when the leg was rebuilt on 2026-08-01. PT $92.97, position about $6,440. Market liquidity $6,286,311 at the 17:00 UTC snapshot and $6,235,183 on a fresh pull twenty minutes later, market total TVL $35,833,772, 24h volume $2,878,354, implied APY 2.83%, underlying kHYPE 2.00%, aggregated 2.23%, max boosted 2.37%,
pendleApy0.094%, PT discount 0.033%, expiry 2026-09-24. Full-exit quote sized to the position: about 68.1 units out, price impact 0.0008%, swap fee $0.04, 0.1% of pool, flagged safe to execute. The quote's output token is the SY, not kHYPE. Source: api-v2.pendle.finance markets and market data endpoints, pendle-mcp liquidity_depth. - HyperEVM footprint: seven active markets, up from five in August (limUSD 26 Nov, vkHYPE and kHYPE both 24 Sep, haHYPE and stHYPE 28 Jan 2027, vkHYPE and kHYPE 25 Mar 2027). A later kHYPE market at
0x697dd29eed8e926205a08400a60d1578154c1a60expires 2027-03-25 if the position is rolled rather than redeemed. - PENDLE token: $2.71, market cap $470.6M, FDV $763.2M, circulating 173,577,810 of 281,527,448 total (61.7%), total supply cross-checked on-chain to the same figure, ATH $7.50 on 2024-04-11, down 45.8% over one year and up 80.9% over thirty days. Source: CoinGecko, 2026-09-19 17:23 UTC.
- Holder concentration: vePENDLE
0x4f30a9d4...63,593,454 (22.59%); sPENDLE0x99999999...414435,269,860 (12.53%); governance Safe0x8119ec16...19,751,622 (7.02%);0xf977814e...acec18,789,587 (6.67%, no code, long published as a Binance hot wallet, label unverified this run);0x399be606db28...16,120,440 (5.73%, contract, 170 bytes);0xa3a7b6f88361...14,572,801 (5.18%, contract, 2,092 bytes);0x5a52e96b...11,300,879 (4.01%, no code); then 2.76%, 1.68%, 1.52%, 1.23%, 1.22%. Top five about 54.5%, top twelve about 72.1%. The two staking contracts together hold 35.12% of total supply. The first four entries were re-read with directbalanceOfcalls and agreed to the token. Source: Ethplorer top-holders, cross-checked on Ethereum RPC. - Recent news scan (1 Aug to 19 Sep 2026): an X search over Pendle's own account returned no security incident, pause, emergency action, governance change or timelock announcement in the window. Pendle Ecosystem USDC vault live on Morpho, announced 12 to 14 August, which is the roadmap item from July actually shipping. Robinhood Chain deployment confirmed 4 September. RWA-related posts appear on 17 September referencing NGI+ markets, but no fresh listing on 17 or 18 September was confirmed, so treat that as refresh. The rest of the H2 2026 roadmap presented 23 July is carried from the August report and was not re-read. Secondary coverage including OAK Research and Coin Bureau still describes the multisig as "2 of 4", which the on-chain reads above contradict for the second report running. Source: Grok X search over @pendle_fi, web search.
- Incident record: DeFiLlama hacks list pulled and searched, 1,273 entries, and no entry names Pendle, checked 2026-09-19. The single adjacent entry is Penpie, 2024-09-03, $27,000,000, classification Reentrancy, parent
magpie-ecosystem. Our own incidents table shows nothing on Pendle since 2026-08-03.
Maintained monthly. Methodology: DeFi Research Instruction v2.