Workspace/Research/Governance attack patterns in 2026

All research
GovernanceDeFi

Governance attack patterns in 2026

Six on-chain vote-buying incidents, one common playbook.

NINadia Ito· Head of DeFi Research2026-05-02 13 min readPR-GOVERN

This note synthesizes four weeks of on-chain settlement data and desk observations. All figures are derived from PRISM's index and cross-checked against public block data.

01Summary

In the trailing 30 days, activity in this segment printed a compound rate that stands one standard deviation above the trailing-year mean. The composition shifted toward larger settlement clips at exchange-labeled counterparties, with a corresponding drop in retail-scale transfers.

We read this as consistent with quarter-end rebalancing rather than a durable regime change. Positioning data from the last four weeks does not yet warrant a structural revision to our base case.

02What the flows say

Settlement flows into exchange-labeled wallets rose -10.2 points on a normalized index. The dispersion across venues narrowed, which typically precedes a compression in realized volatility over the next 10–15 sessions.

Market-maker inventory, measured by end-of-day balance dispersion, tightened alongside the rise in venue-directed flow. This is the tell that professional participants are absorbing the marginal supply rather than distributing it further.

Fig 1 · Normalized flow index, 30d
Inflow Outflow
Fig 1. Rolling flow index (t=0 anchored) versus complementary outflow series. Source: PRISM index.
Concentration is not, by itself, evidence of stress. It is evidence that a smaller set of actors is now doing the work of price discovery.
Nadia Ito, Head of DeFi Research

03Positioning implications

The composition of inflows favors size over frequency, which raises the marginal cost of a directional dislocation. That argues for tighter stops in perp books and a modest widening in RFQ two-way markets over the next week.

We continue to prefer expressions that isolate venue-specific microstructure rather than outright directional exposure until the flow footprint normalizes.

Fig 2 · Weekly inflow vs outflow, $M
Fig 2. Aggregated venue flows by week. Source: PRISM label registry & block data.

04Risks to this view

The primary risk is that the concentration we observe is the leading edge of a distribution rather than an absorption. A break of the trailing 20-day flow-to-price correlation, particularly during the North American session, would be the earliest signal to revise.

A secondary risk is data. Attribution at the Governance venue level relies on labels curated in the last twelve months; we flag two counterparties whose label confidence sits below our normal threshold in the appendix.

AData appendix

Top counterparties · 30d
Wintermute
$182.60M
Entity
WintermuteMarket Maker
Chain
Ethereum
30d Flow
$182.60M
Share
18.2%
Jump Trading
$148.90M
Entity
Jump TradingMarket Maker
Chain
Ethereum
30d Flow
$148.90M
Share
14.8%
Binance 14
$121.30M
Entity
Binance 14Exchange
Chain
Ethereum
30d Flow
$121.30M
Share
12.1%
Coinbase 3
$96.40M
Entity
Coinbase 3Exchange
Chain
Base
30d Flow
$96.40M
Share
9.6%
a16z
$74.10M
Entity
a16zFund
Chain
Ethereum
30d Flow
$74.10M
Share
7.4%
Paradigm
$62.80M
Entity
ParadigmFund
Chain
Ethereum
30d Flow
$62.80M
Share
6.3%
OKX 7
$48.20M
Entity
OKX 7Exchange
Chain
Arbitrum
30d Flow
$48.20M
Share
4.8%
GSR
$41.70M
Entity
GSRMarket Maker
Chain
Ethereum
30d Flow
$41.70M
Share
4.2%
Datasetds-governance-attacks-2026
Flows · Governance, DeFi
Dataset: Token flowsWindow: Last 30 daysAmount: > $1,000,000Labels: Governance, DeFi
Disclosures

This report reflects the views of the PRISM research desk at the time of publication and is provided for informational purposes only. Nothing herein is investment advice, an offer, or a solicitation. On-chain attribution is subject to label confidence; see the appendix for label provenance.

More from the desk