The Shape of DeFi (Part III)

Part III of III in The Shape of DeFi series. Read Part I: Mapping by Function and Part II: Tracing by Behaviour.

---

In short: Scams and exploits both use DeFi on Ethereum, but in different ways. Between 1 January 2024 and 25 August 2026, Chainlabs data shows about $74M of stablecoin volume between scam-labelled addresses and DeFi contracts, almost two-thirds of it on decentralised exchanges (DEXs) and a quarter on bridges. Just over half of that volume resolves to named entities, and those entities typically use one venue each. Exploit-labelled addresses show about $161M of stablecoin volume plus 12,985 ETH from 166 addresses, more than two-fifths of it from one incident, the Cetus hack, and exploit entities touch about twice as many protocols each. Close to half of the scam volume sits under catch-all labels that cannot be tied to a single actor. All figures count both directions and cover one direct hop on Ethereum.

On 22 May 2025, Cetus, a DEX on the Sui network, was hacked. That day, $40.9M arrived on Ethereum, $34M of it through a cross-chain bridge in thirty-four payments of almost exactly a million dollars, and $35.9M was fed into a single DEX. The whole sequence took about ninety minutes.

Over the previous year, six Ethereum addresses later listed in an SEC complaint had run the same two steps in the opposite order: ETH sold for USDT on a DEX, then about $12.8M sent out through a bridge to TRON.

The two cases sit at either end of this study, which crossed our scam and exploit labels with our DeFi labels and measured every direct transfer between them on Ethereum. Scam-related volume runs mostly through DEXs and bridges, one venue at a time. Exploit-related volume is larger, dominated by a single incident, and spread across more protocols.

Where does scam-related volume go in DeFi?

Most of the volume passes through venues built for swapping or moving funds: almost two-thirds is on DEXs, a quarter on bridges and a tenth on lending markets. Very little appears in products that hold money to earn a return, such as staking, yield and structured products.

The $74M of scam-related volume counts both directions, so it is volume, not money that moved into DeFi: a swap puts one leg in and one leg out.

Who is behind the scam-related volume?

Just over half of the scam-related volume can be tied to named entities. Just over a third belongs to drainer-family entities (drainers are phishing kits, often rented out to affiliates, that trick victims into signing transactions that empty their wallets), a fifth to other named entities, and the remaining 45% sits under catch-all labels that cannot be tied to a single actor.

Just over half of that drainer total comes from a single address. Without it, the rest of the drainer-family entities account for about one sixth of all scam-related volume.

Catch-all labels look more spread out than named entities only because each one groups about ten addresses together.

Guillaume Donnet, Solutions Analyst at Chainlabs, puts it simply: "When we can resolve an address to a named entity, the behaviour turns out to be simple: one venue, usually once. The part that looks messy is mostly report labels that group many unrelated addresses under a single name."

What does a named case look like end to end?

It shows money arriving, changing form on a DEX and leaving through a bridge. In December 2025 the U.S. Securities and Exchange Commission sued three purported crypto trading platforms, among them Morocoin Tech Corp., and four "investment clubs". It alleges a scheme that took at least $14 million from U.S. retail investors between January 2024 and January 2025. The complaint lists the crypto addresses that, it says, received the money: six on Ethereum, four on Bitcoin and five on TRON. Our data labels the six Ethereum addresses.

Between February 2024 and early 2025 those six addresses received about $18 million in stablecoins and some 1,350 ETH from addresses outside the group; who sent it is not visible on chain. The ETH was sold for USDT on Tokenlon, a DEX, and the money was pooled into a few of the six addresses.

From there about $12.8 million left Ethereum through Transit Swap and the SWFT cross-chain bridge. The bridge's own records name where each transfer was going: $12.1 million was sent to TRON as USDT, $11.9 million of it to four TRON addresses. All four are among the five the complaint lists.

The case also shows the limit of a one-hop view. Counting only direct transfers between these addresses and the DeFi contracts in our catalogue at the time, it accounts for $3.8 million. The rest moved through contracts not yet catalogued, so the totals in this study are a floor.

Do exploits use DeFi the same way scams do?

They spread wider. Measured the same way, addresses labelled as exploit-related in our data show about $161M of stablecoin volume with DeFi contracts over the same period, from 166 addresses, plus about 12,985 ETH. A single incident accounts for more than two-fifths of that.

Exploit entities touch about twice as many protocols as scam entities: 2.54 on average, versus 1.1 to 1.3 for the scam entities we can name.

Set side by side, the two cohorts look very different: about $74M from 1,366 scam addresses, and about $161M from 166 exploit addresses. Because one incident carries so much of the exploit figure, an average per address would mean little. The ETH is reported in ether, as in Part II, and is never converted to dollars or added to the stablecoin figure.

These are the exploits we have labelled, not every exploit. Our exploit labels are a separate and newer set from our scam labels, and the two barely overlap: of 702 labelled Ethereum exploit addresses, only two appear in the scam data.

What happened on Ethereum on the day of the Cetus hack?

Money arrived from another chain and was fed straight into a DEX. Cetus, a DEX on the Sui network, was exploited on 22 May 2025. Public reporting puts the loss at about $220M to $223M, with roughly $162M frozen by Sui validators, according to The Defiant, Cointelegraph and The Block.

What we see is the Ethereum leg of an exploit that happened on another chain. Between 10:48 and 12:01 UTC, about $40.9M in USDC arrived at an address our data labels as Cetus Exploit: $34M through Mayan, a cross-chain bridge, in 34 payments of almost exactly $1M inside half an hour, and $6.9M from Sui through Circle's Cross-Chain Transfer Protocol (CCTP), which moves USDC between chains by burning it on one chain and minting it on the other. Between 10:51 and 12:20, $35.9M of it went into CoW Protocol, in transfers that grew from $1-2M to $5M and more.

"No single transfer here would stand out on its own. It's the shape that gives it away: round amounts, a half-hour window, and swaps into the DEX getting bigger as the payments cleared," says Martín Jofré, Lead Analyst at Chainlabs. "For anyone monitoring a bridge or a DEX, the window to act on a pattern like that is under two hours."

What left CoW Protocol is not visible in our data. CoW pays out through internal calls inside its settlement contract, which the dataset used here doesn't capture, so we can't yet infer where the money went next.

What makes the route visible at all is the data behind it. "We can describe the Cetus route only because two independent catalogues line up: our DeFi labels name both the bridge and the DEX, and the exploit address comes from a separate trace set built a different way," Donnet explains. "Remove either one and the ninety minutes is just unattributed traffic."

How does this differ from the operator in Part II?

The two studies measure different things, so the comparison has limits. Part II showed one operator running thousands of addresses through a mixer, across layer 2 networks (separate networks that process transactions and settle back to Ethereum) and back again. This study measures one direct hop, so it cannot show what happened to this money before or after it. At that hop, named scam entities use one venue and exploit entities spread out.

What does this mean for compliance teams?

Scams and exploits call for different controls. Named scam entities use a single DEX or bridge, so those venues are where most scam-related volume shows up. Exploit funds move faster and across more protocols, so no single venue sees the whole route. Catching them depends on the exploit address already being labelled when the funds arrive.

In both cases, the label on the address is what turns a transfer into an alert. A $1M payment from an unlabelled address looks like routine traffic. The same payment from a labelled drainer affiliate or exploit address is a reason to stop and look.

Why does Chainlabs focus on naming the actor?

The three parts show that a pattern is only as useful as the data naming the actor behind it. Part I showed that ranking DeFi by assets held misses what protocols actually do. Part II showed that one busy operator can look like a market-wide trend until you break the figure down.

Part III finds the same thing twice. Set aside one address and the drainer share of scam volume roughly halves. Set aside one incident, and the exploit figure falls by more than two-fifths. And close to half of the scam volume cannot be attributed to a named actor at all. You can only identify the actor behind a pattern if the data names them. Or, as Jofré puts it: "If you cannot name who is behind a flow, you cannot tell whether you are looking at one actor or two hundred." To see how Chainlabs data can be used, visit our Solutions page.

Key terms

• Decentralised finance (DeFi): financial services such as trading, lending and staking that run on smart contracts rather than through a company.
• Decentralised exchange (DEX): a smart contract that lets users swap one token for another without a central operator.
• Bridge: a service that moves tokens from one blockchain to another.
• Drainer: a phishing kit, often rented out to affiliates, that tricks victims into signing transactions that empty their wallets.
• Exploit: an attack that uses a flaw in a protocol's code to take funds.
• Cross-Chain Transfer Protocol (CCTP): Circle's system for moving USDC between chains by burning it on one chain and minting it on the other.
• Layer 2: a separate network that processes transactions and settles them back to Ethereum.
• Mixer: a service that pools funds from many users to break the on-chain link between sender and receiver.
• One hop: a direct transfer between two addresses, with no other address in between.
• Catch-all label: a label that groups many unrelated addresses under a single name.

Method and limits

• Scope: Ethereum only; direct transfers, one hop, between a labelled address and a labelled DeFi contract; 1 January 2024 to 25 August 2026; public chain data plus Chainlabs labels.
• What we measure: every figure is stablecoin transfer volume, counted in both directions. A swap puts one leg in and one leg out, so volume is not the same as money that moved into DeFi.
• Value measured: stablecoins (USDT, USDC) in dollars; ether reported separately in ETH and never converted. ETH-denominated value on the scam side is not counted at all, so those totals are a floor. The $74M counts only USDT and USDC.
• Labels: DeFi labels from v8 of our catalogue, joined at query time; scam labels by resolved owner; exploit labels from our exploit trace set. Dated 27 October 2026 (scams) and 16 October 2026 (exploits). "Labelled X in our data" describes our attribution, not a finding about the entity.
• Two cohorts: the scam and exploit label sets are separate and barely overlap, so their totals are never added together.
• Exclusions: we exclude smart-contract addresses on the labelled side, a three-day bulk ingestion in March 2026 that produced one-off contacts across many entities, one address whose profile is infrastructure rather than a scam actor, and $5.87M on contracts the current catalogue no longer labels.
• Known limits: internal ETH transfers are not captured, so value a DEX pays out through internal calls is invisible here. One hop only. Ethereum only: other chains are not covered.
• Case study: figures for the six addresses come from public Ethereum data and the SWFT bridge's own events, read on 29 October 2026, and go beyond the one-hop view used for the totals. The SEC's claims are allegations.

FAQ

How much scam-related money touches DeFi on Ethereum?

Between 1 January 2024 and 25 August 2026, Chainlabs data shows about $74M of stablecoin volume between scam-labelled addresses and DeFi contracts on Ethereum, counting both directions. That is volume, not money moved into DeFi. Almost two-thirds is on DEXs and a quarter on bridges.

How much exploit-related money touches DeFi on Ethereum?

Over the same period, addresses labelled as exploit-related in Chainlabs data show about $161M of stablecoin volume with DeFi contracts, from 166 addresses, plus about 12,985 ETH. A single incident, the Cetus exploit, accounts for more than two-fifths of that.

Do scams and exploits use DeFi differently?

Yes. The scam entities Chainlabs can name typically use one venue each. Exploit entities touch about twice as many protocols each.

Can the actors behind scam-related volume be identified?

Just over half of the volume can be tied to named entities in Chainlabs data. Close to half sits under catch-all labels that cannot be attributed to a named actor.

---

The Shape of DeFi is a three-part series built on Chainlabs' internal taxonomy. Data runs to 25 August 2026. Scam labels are from the Chainlabs catalogue as of 27 October 2026, and exploit labels as of 16 October 2026.

Want to use this data in your own investigations? Book a call with our team.

Research & Data: Martín Jofré, Lead Analyst, and Guillaume Donnet, Solutions Analyst

Editorial: Scott Mallen