defi

Morpho has billions in locked assets, millions in fees, and one number that deserves investors’ attention: $0 in recorded protocol revenue.
According to the DeFiLlama
• TVL: $11.402B
• Active loans: $5.819B
• 30-day fees: $22.71M
• 30-day protocol revenue: $0
• MORPHO price: $2.01
• Market cap: $1.416B
• FDV: $2.014B
So, what’s happening?
Fees and revenue are not the same thing. Morpho Blue’s fee configuration allows the protocol to facilitate lending activity without currently recording protocol revenue under the displayed metric.
That doesn’t mean Morpho generates no fees. It means investors must understand who captures the economic value.
Is MORPHO undervalued?
Its market cap is approximately 12.4% of TVL, but that ratio alone proves nothing. TVL is not profit, and gross fees do not automatically belong to token holders.
MORPHO is a governance token. Any potential benefit from protocol fees depends on actual governance decisions and implemented mechanisms, not assumptions.
My take: Morpho’s adoption is impressive, but its token valuation needs more than a TVL comparison. Watch fee-switch decisions, sustainable lending demand, and token unlocks before drawing conclusions.
Because a successful protocol and a valuable token are two different investment theses.
$MORPHO #Morpho #DeFi

A flash loan bought enough votes to drain $4.85M with no governance delay. Here's the attack step by step, and three red flags to look for before you deposit.
🏛️ On Saturday, an attacker borrowed money, bought a controlling vote in a DeFi project, and drained its treasury, all inside one transaction.
X100, a project on Ethereum, lost about $4.75M to $4.85M on October 24. Its token fell more than 96% as liquidity disappeared. The scary part isn't a coding bug. The contracts did exactly what they were built to do.
🔍 How the attack worked, step by step.
The attacker borrowed about 1.94M USDT through an Aave flash loan, a loan that must be repaid within the same transaction.They bought X tokens and split them across two contracts they controlled.Each contract staked slightly more than 19,000 X into X100's Freezer, which gave them two of the project's three "Senate" seats.With a majority, they passed a proposal forcing the treasury to sell 400,000 X into a pool they had created, accepting a payout of about 36 USDT.They pulled the liquidity back out, sold the tokens, repaid the loan and kept roughly $4.75M. A second attacker repeated the trick about 24 minutes later.
🧠 Why it worked.
New Senate members could approve and execute proposals immediately, with no waiting period. A delay of even a few hours would have broken the attack, because a flash loan has to be repaid in the same transaction. Voting power was also something anyone could rent for a few cents of fees.
🚩 Three red flags to check before you deposit.
No delay. Can governance changes execute instantly, or is there a timelock?Votes you can borrow. If voting power comes from tokens that can be bought or borrowed in seconds, it can be attacked.A tiny council. When two or three seats control a treasury, taking the majority is cheap.
✅ What this means for you
If you use DeFi, read the governance section of a project's docs before you deposit, and look for timelocks, audits and the number of signers.
If you're on the sidelines, this is a reminder that "audited" doesn't always cover how governance is designed.
If you hold X100 tokens, the project hadn't published an incident report or recovery plan in the first hours, so watch its official channels and be careful with anyone offering "recovery" links.
🟢 Bullish scenario
The team publishes a clear report, adds a timelock and redesigns governance, and the incident becomes a case study that other projects learn from.
🔴 Risk scenario
Copycats target similar designs, stolen funds are mixed and moved out, and holders get no recovery.
👀 Three things to watch
1️⃣ An official incident report from X100
2️⃣ Where the stolen funds, reportedly converted to about 2,022 ETH, move next
3️⃣ Similar governance designs getting audited or patched
💡 The key takeaway
X100 wasn't hacked through a typo in the code. It was hacked through its own rules, which let anyone buy a majority and act on it instantly.
The real question isn't whether the code is audited. It's whether governance can be rented for a minute.
That is the part worth watching.
This post is for informational and educational purposes only and is not financial advice. Crypto markets are volatile. Always conduct your own research before making financial decisions.
#BinanceSquare #DeFi #Ethereum #CryptoSecurity #FlashLoan

That’s one reason I find @ston_fi interesting.
Built on TON, STON.fi makes token swaps accessible through a decentralized exchange integrated with the TON ecosystem. Users can exchange assets while keeping control of their own wallets.
What matters to me is how infrastructure like this helps make onchain activity easier for everyday users. As more people explore TON apps, simple and reliable swap experiences become increasingly important.
The next stage of DeFi isn’t just about adding more tokens. It’s about making decentralized finance easier to understand and use.
I’m watching how @ston_fi continues to contribute to the TON ecosystem.
#STONfi #tonecoin #DeFi