TL;DR: Monad has reached about USD 1 billion in TVL, with USD 2.64 billion in 30-day DEX volume, USD 2.5 billion in perpetual volume, and USD 1.11 billion in lending supply, while activity concentrates around a small set of venues, according to CertiK. That pattern shows breadth is turning into market structure, and governance now matters as much as throughput.
At a glance
What this is: CertiK analyses how Monad's onchain financial activity is maturing into a multi-layer ecosystem with concentrated liquidity, lending, settlement, and RWA activity.
Why it matters: For IAM and security teams, this matters because the same concentration effects that drive market efficiency also create higher-value control points, operational dependencies, and governance expectations across wallets, smart contracts, validators, and distribution layers.
By the numbers:
- As of October 16, 2026, Monad held approximately USD 1 billion in total value locked.
- Over the 30 complete UTC days from September 16 to October 15, Monad's DEXs processed USD 2.64 billion in spot volume.
- Tracked lending markets held USD 1.11 billion in gross supply and USD 613.1 million in borrows.
- CertiK says Monad's stablecoin layer represented USD 672.8 million in market capitalization.
Context
Monad's growth is no longer best understood as simple app count. The more useful question is whether trading, lending, settlement, and real-world assets are forming a governable financial stack, and whether the controls around that stack are keeping pace with the liquidity it is attracting.
That matters because concentration can improve market depth while also increasing operational dependence on a small number of execution venues, credit venues, and settlement assets. In practice, the security and governance question shifts from deployment volume to how delegated onchain flows are authorised, routed, and bounded.
Key questions
Q: How should teams govern onchain liquidity when activity concentrates in a few venues?
A: Treat concentration as a governance issue, not just a market outcome. Focus on the venues, routers, and assets that carry most volume, because they define where operational failure, manipulation, or dependency risk will matter most. Governance should follow actual flow, not protocol count, and monitoring should prioritise the paths that would create the largest blast radius if they failed.
Q: When does lending activity become a systemic dependency rather than a local market?
A: Lending becomes systemic when supplied capital is reused across borrowing, liquidity provision, and settlement. At that point, stress in one venue can spread through collateral quality, utilisation, and market confidence. Teams should watch for reuse patterns, concentration in a few markets, and dependence on a narrow set of borrowable assets before assuming the credit layer is resilient.
Q: What are the warning signs that a DeFi ecosystem is becoming too dependent on a few assets?
A: Look for a small number of stablecoins, collateral types, or RWAs dominating supply, borrow, and transfer activity. When one asset class becomes the main settlement medium or collateral source, governance risk rises because issuer assumptions and liquidity conditions can affect multiple parts of the stack at once. Diversity only helps if the alternatives are actually used.
Q: How do security teams think about route authority in blockchain ecosystems?
A: Think of route authority as the ability to move value, not just the ability to interact with a contract. The key question is which wallets, contracts, routers, and interfaces are authorised to initiate, aggregate, or settle flows. If that authority is too broad, the ecosystem's blast radius grows even when the underlying contracts are functioning as designed.
Technical breakdown
How liquidity concentration changes the control surface on chain
When a network matures, volume tends to concentrate in a few venues even if many protocols remain live. That does not just alter market structure. It changes which contracts, pools, routers, and interfaces become the most important operational trust anchors. In DeFi, concentration means one or two execution paths can dominate slippage, routing, and settlement behaviour, so failures or configuration errors in those paths have outsized effect. For practitioners, the architectural lesson is that breadth of listings is not the same as breadth of resilience. The effective control surface is defined by where order flow and liquidity actually settle, not by how many protocols are deployed.
Practical implication: Map the highest-volume execution paths first and treat them as priority governance and monitoring targets.
Why lending creates a reusable balance-sheet layer
Lending markets turn static deposits into reusable credit, which means supplied assets can support borrowing, liquidity provision, and further trading activity. That reuse is what makes lending a balance-sheet layer rather than just another app category. Utilization, borrow concentration, and collateral composition become the meaningful controls because they show how much of the network's capital can be repledged or stressed at once. In a multi-venue ecosystem, the lending layer also becomes an important dependency for trading and settlement. If credit dries up or collateral quality changes, the effect is not isolated to the lending market. It propagates through the broader financial stack.
Practical implication: Track collateral composition and utilization together, then stress-test the venues that depend on borrowed capital.
How stablecoins and RWAs extend settlement trust
Stablecoins provide a common unit of account and settlement medium across trading, credit, and payments, while tokenized RWAs add asset-side diversity and new concentration risks. The issue is not simply whether an asset exists on chain. It is whether the network can govern redemption assumptions, transfer velocity, issuer dependency, and asset-specific liquidity conditions. Credit-heavy RWAs behave differently from generic tokenized assets because they carry embedded assumptions about yield, maturity, and counterparties. That makes settlement governance, issuer trust, and asset inventory more important as the ecosystem expands.
Practical implication: Classify each settlement asset by its trust assumptions and restrict overreliance on any single issuer or asset type.
Breaches seen in the wild
- Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Monad's real milestone is not app count, it is liquidity governance. A network can host many protocols without becoming operationally cohesive. Once order flow, lending demand, and settlement activity concentrate, the practical control problem shifts to the venues and assets that carry most of the value. That makes governance, routing discipline, and dependency management the real measures of maturity.
Capital reuse is the hidden risk multiplier in DeFi ecosystems. Lending turns deposits into collateral, collateral into borrowing capacity, and borrowing into more market activity. That improves capital efficiency, but it also means stress can propagate faster than a simple app inventory would suggest. Practitioners should treat concentration in lending and perpetual venues as a systemic dependency, not a local optimisation problem.
Delegated onchain flows deserve identity-style governance. Even though this is a blockchain ecosystem, the control question looks familiar to IAM teams: who or what is authorised to move value, through which route, and with what boundaries? Delegated onchain flows should be evaluated like scoped access paths, because route authority, not just contract existence, determines blast radius.
Stablecoins and RWAs create a settlement trust model that must be measured, not assumed. The article shows a network where settlement assets, credit products, and distribution channels are all expanding together. That makes issuer concentration, redemption dependence, and asset turnover central governance variables. The practitioner conclusion is straightforward: asset diversity is only useful when the trust assumptions behind each asset are explicit and continuously reviewed.
Monad is evolving into an ecosystem where security visibility must extend above the base layer. The operational record is strong, but ecosystem risk increasingly sits in contract composition, liquidity concentration, and third-party market interdependence. That is the point where onchain security becomes a governance discipline, not just a protocol property. Teams should measure exposure at the market layer, not only at consensus.
What this signals
Concentration risk will become the dominant governance theme in mature onchain ecosystems. Once volume, fees, and credit all cluster around a few venues, the programme risk is no longer protocol inventory. It is dependency on the small set of paths that actually move value, settle trades, and absorb borrow demand.
Route-level governance will matter more than chain-level abstraction. Security teams should expect the next phase of control design to focus on who can initiate, aggregate, and settle flows across wallets, routers, and credit venues. That is where control boundaries become visible in practice.
Liquidity, not deployment count, is the signal that should shape prioritisation. A network can look broad while still relying on a narrow set of market leaders and settlement assets. The practical response is to align monitoring, review, and incident planning to the venues where the capital actually concentrates.
For practitioners
- Prioritise governance around the highest-volume venues Identify the DEXs, perpetual markets, and lending pools that carry the most activity, then assign monitoring and review priority to those paths first because they define the real control surface.
- Model capital reuse across lending and trading Trace how supplied assets move from deposit to borrow to liquidity provision to settlement so you can see where stress or manipulation could propagate across the stack.
- Classify settlement assets by trust assumption Separate stablecoins, tokenized credit products, and other RWAs by issuer dependency, redemption behaviour, and liquidity profile before allowing them to underpin critical flows.
- Treat route authority as a governance control Review which wallets, routers, contracts, and interfaces are allowed to initiate or aggregate value-moving actions, and narrow that authority where possible.
- Monitor concentration as an operational risk signal Watch for rising dependence on a small number of venues, fee sources, or asset categories, since concentration can turn a healthy ecosystem into a fragile one.
Key takeaways
- Monad's ecosystem shows that breadth and concentration can coexist, but the operational risk profile is determined by where liquidity and credit actually settle.
- The network's lending, trading, and stablecoin layers now behave like a connected financial stack, which means a dependency in one layer can affect the others.
- Practitioners should prioritise governance at the routes, venues, and assets that carry the most value, because those are the control points that matter most in practice.
Related NHI Mgmt Group resources: OAuth Token Exchange and Delegation Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CSA Cloud Controls Matrix, NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| CSA Cloud Controls Matrix | IAM — Identity and Access Management | Role and route authority over value-moving flows maps to cloud-style access governance. |
| Recommendation — Apply IAM-style access governance to route and contract authority that can move or settle value. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centres on who can initiate, route, and settle financial flows across the ecosystem. |
| Recommendation — Review permissions and authorisations for wallets, routers, and contracts that control value movement. | ||
| CIS Controls v8 | CIS-5 — Account Management | The ecosystem depends on managed accounts, wallets, and operational roles with scoped authority. |
| Recommendation — Inventory and govern privileged accounts and wallets that can influence settlement or lending flows. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Concentrated onchain routes create high-value paths for credential abuse and movement across systems. |
| Recommendation — Map high-value routes to credential access and lateral movement scenarios in your threat model. | ||
Key terms
- Liquidity Concentration: Liquidity concentration is the tendency for trading volume, fee generation, or borrowing activity to cluster around a small number of venues. In practice, it creates fewer but more important control points, because failures or configuration changes in the dominant paths affect the majority of user activity.
- Capital Reuse: Capital reuse is the process of moving the same asset through deposit, borrowing, liquidity provision, and settlement functions across a financial stack. It increases efficiency, but it also links risk across venues, so stress in one layer can propagate quickly into others.
- Settlement Asset: A settlement asset is the medium used to finalise transfers, collateralise loans, or price transactions across a network. Its trust assumptions, redemption behaviour, and liquidity profile matter as much as its market value, because these properties shape how reliably the rest of the ecosystem can operate.
- Route Authority: Route authority is the permission to initiate, aggregate, or settle value-moving actions through wallets, routers, contracts, or interfaces. It is an access-control concept for onchain systems, and it determines blast radius when a path is over-authorised or misused.
Deepen your knowledge
NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity controls to the broader systems that move value and enforce access in modern environments.
Published by the NHIMG editorial team on October 22, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org