Blockchain and DeFi audit reveals extreme capital inequality and hidden concentration risks

Decentralized finance was supposed to dissolve economic power across thousands of autonomous protocols, replacing centralized intermediaries with open code and transparent ledgers. A new empirical audit published in Frontiers in Blockchain suggests the opposite is happening in practice. Researchers led by William Villegas-Ch of Universidad de Las Américas in Quito, Ecuador, integrated five publicly available data sources into a single analytical framework and found that the blockchain and DeFi ecosystem exhibits extreme capital inequality, measurable illicit-transaction risk, and mechanism-design vulnerabilities that closely resemble structural patterns long observed in traditional finance. The study, published on 25 September 2026, is among the first to examine concentration, intelligent agents, and mechanism design jointly rather than as separate research topics.

The team built what they call a reproducible audit protocol, processing four primary data sources through a common canonicalization pipeline while adopting Uniswap decentralization indices as a published derived series. The sources included DeFiLlama Total Value Locked (TVL) data covering 7,928 protocols, the Elliptic Bitcoin dataset of 203,769 transactions, a multi-year sample of ERC-20 trading activity from the Harvard Dataverse, and Bitcoin incentive series spanning more than 6,400 daily observations. The audit was deliberately forensic in character. Every file received a SHA-256 fingerprint, schema profiling classified columns using blockchain-specific regular expressions, and stratified sampling verified that data values actually matched their declared column order. That verification step proved essential: the January 2024 ERC-20 snapshot contained a cyclical column shift in its last six fields, which the researchers detected by checking USDC transactions against the token’s publicly known six-decimal precision and corrected through explicit column remapping before any aggregation.

The headline finding concerns the distribution of capital across the DeFi ecosystem. Across the 5,724 protocols with positive TVL, the Gini coefficient reaches 0.985 for aggregated TVL, with a bootstrap 95 percent confidence interval of [0.977, 0.991], and remains 0.978 even when centralized exchanges are excluded. A Gini coefficient this close to 1.0 describes a distribution in which nearly all capital sits with a tiny fraction of protocols. Yet the corresponding Herfindahl–Hirschman Index tells a different story: 0.090 on the conventional 0–10,000 scale, well below antitrust thresholds for high market concentration. The divergence is not contradictory, the authors explain, because the Gini coefficient is sensitive to inequality across the full long-tailed distribution of protocols, while the HHI is dominated by the squared shares of the largest units and is conventionally read as a market-concentration statistic. Extreme inequality and moderate market concentration can therefore coexist in the same snapshot.

The category breakdown carries methodological consequences for anyone who quotes aggregate TVL as a measure of DeFi growth. Centralized exchange custody alone accounts for 242.54 billion dollars, or 50.17 percent of aggregate TVL, more than bridges, lending, liquid staking, and real-world assets combined. The researchers argue that a substantial proportion of the capital commonly reported as DeFi TVL corresponds to custody reserves held by centralized exchanges rather than to capital secured by non-custodial smart contracts, meaning the associated risk profile reflects counterparty and custodian risk instead of the smart-contract risk that defines decentralized finance. For regulators, the implication is that headline concentration statistics should be decomposed by category before systemic-risk thresholds or capital requirements are calibrated, since a single aggregated Gini or TVL figure conflates custodial and non-custodial risk into one number.

Network-level decentralization dynamics proved equally heterogeneous. Using precomputed daily Uniswap indices across Ethereum L1, Arbitrum, Optimism, and Polygon between June 2021 and December 2022, the team found statistically significant differences across all four networks for every decentralization metric. Ethereum L1 remained comparatively stable, while Arbitrum’s Gini coefficient fluctuated between roughly 0.50 and 0.95, consistent with thin markets where the entry or exit of a single large liquidity provider substantially alters concentration. Arbitrum also recorded an extreme HHI peak above 1,100 during its launch phase in August 2021, coinciding with an initial migration of liquidity driven by a small group of early adopters. Polygon reached Nakamoto coefficients one to two orders of magnitude higher than the other networks, with peaks approaching 22,000, plausibly reflecting lower transaction costs that make participation feasible even for users trading small amounts. The authors caution, however, that the Nakamoto coefficient and effective-diversity measures scale mechanically with the number of active addresses, so Polygon’s larger participant base amplifies those measures even though the Gini coefficient does not identify Polygon as an equivalent outlier.

The ERC-20 analysis revealed a striking decoupling between participant growth and transaction activity after 2021. The number of unique issuing addresses contracted slightly from 2,738,732 in January 2021 to 2,709,025 in January 2024, while total transactions increased by roughly 28 percent over the same period, from 26.1 million to 33.4 million monthly transactions. This divergence between the extensive margin, meaning the number of participants, and the intensive margin, meaning transactions per participant, indicates that recent growth is concentrated in transaction intensity rather than in the expansion of the issuing population. Automated agents, smart contracts, bots, and batch execution are plausible mechanisms for this pattern, although aggregated snapshot data cannot identify their individual contributions. Meanwhile, the number of unique receiving addresses nearly doubled between 2021 and 2024, an asymmetry consistent with the growing use of airdrops, one-to-many reward distributions, and decentralized exchange routers acting as intermediate recipients. Active tokens grew near-exponentially from 14,722 in 2019 to 47,647 in 2024, reflecting the extremely low technical barrier to deploying new tokens and successive speculative cycles associated with meme tokens.

On the intelligent-agents pillar, the team trained a Random Forest classifier with 200 trees on the Elliptic Bitcoin dataset, using transactions from time steps 1 to 34 for training and reserving steps 35 to 49 for testing to prevent information leakage from future observations. The classifier identified illicit Bitcoin transactions with a precision of 0.988 and a recall of 0.692, with an F1-score of 0.814, ROC-AUC of 0.931, and Average Precision of 0.795, consistent with the original Elliptic benchmark. The asymmetry defines the operational profile such a system would exhibit in deployment: it would rarely flag legitimate transactions, minimizing friction for honest users, but would fail to detect approximately 31 percent of illicit transactions. The authors conclude the model is better suited as a prioritization tool for human review than as a fully automated transaction-blocking mechanism, a distinction with direct implications for anti-money-laundering systems operating on public blockchains.

Explainability analysis sharpened the picture further. Using SHAP values computed with TreeExplainer on a random sample of 3,000 test transactions, the researchers found that local transaction features account for 74.4 percent of the aggregate mean absolute attribution, compared with 25.6 percent for neighborhood features derived from one-hop graph statistics. That split exceeds the 56.4-to-43.6 ratio implied by the 93-to-72 feature-count difference between the two groups, and on a per-feature basis local features received roughly 2.25 times the attribution of neighborhood features. Four of the five top-ranked individual features were local. The authors are careful about interpretation: because neighborhood features are constructed from statistics of neighboring transactions’ local features, the two groups are correlated by construction, and Shapley-value attribution under correlated features can distribute credit unevenly. The result indicates how the analyzed Random Forest uses the two feature groups, not that transaction-level variables contain intrinsically greater predictive information.

The mechanism-design comparison between Aave V3 and Compound V3 revealed statistically significant architectural differences. Aave V3 exhibited a mean borrowed-to-deposited ratio of 0.410, with a bootstrap 95 percent confidence interval of [0.392, 0.430], compared with 0.300 for Compound V3, with a confidence interval of [0.293, 0.306]. A Mann–Whitney U test confirmed the difference with a very large effect size, indicating almost complete separation between the monthly distributions. The authors attribute the contrast at least partly to market architecture: Aave V3 operates as a multi-asset pooled money market in which most listed assets can be simultaneously supplied and borrowed, while Compound V3’s Comet design centers on a single borrowable base asset per deployment. Utilization–volatility associations differed descriptively in sign between protocols, positive and weak in Aave V3, negative and moderate in Compound V3, but the researchers stress these are descriptive balance-sheet co-movements in USD-denominated series that partly absorb collateral-price movements, not clean mechanism-design effects. An illustrative Aave V3 oracle configuration error recorded in March 2026, exposing approximately 862,000 dollars before full recovery, demonstrated that even protocols with stable utilization dynamics remain vulnerable to a separate class of mechanism risk: the integrity of their price-oracle infrastructure.

For Bitcoin, the audit found that block subsidies dominate miner revenue throughout almost the entire 6,409-day observation period from 2009 to July 2026, reflecting the geometric reductions of successive halving events rather than the emergence of a mature transaction-fee market. Intermittent increases in the fee share of revenue appear consistent with episodic demand conditions, potentially including bull-market activity and intensified inscription or Ordinals usage, rather than a sustained structural shift. The close correspondence between mining difficulty and estimated hash rate functioned as a validity check confirming correct series alignment, since Bitcoin’s protocol mechanically retargets difficulty every two weeks. The authors conclude that the stable revenue base required to support Bitcoin’s long-term security budget has not yet been established, and that as subsidies decline toward zero over coming decades, transaction fees will necessarily become an increasingly important component of miner revenue. Taken together, the findings suggest that despite the technological innovations of blockchain, DeFi, and artificial intelligence, the resulting ecosystem continues to reproduce structural risk patterns also observed in traditional financial systems, and that the study’s principal contribution lies in a reproducible, cross-source audit framework that treats concentration, intelligent agents, and mechanism design as a unified, empirically verifiable object of study.

Subject of Research: Blockchain and decentralized finance audit reveals extreme capital inequality, explainable illicit-transaction detection, and mechanism-design risks across protocols

Article Title: A multi-source empirical audit of blockchain and DeFi: concentration, intelligent agents, and mechanism design

Article References: Villegas-Ch, W., Navarrete, A. M., Gutierrez, R., & Sarango-Lalangui, P. (2026). A multi-source empirical audit of blockchain and DeFi: concentration, intelligent agents, and mechanism design. Frontiers in Blockchain, 9, Article 1949598. https://doi.org/10.3389/fbloc.2026.1949598

Image Credits: AI Generated

DOI: 10.3389/fbloc.2026.1949598

Keywords: blockchain, DeFi, Total Value Locked, Gini coefficient, illicit transactions, SHAP, mechanism design, Bitcoin, Aave, Compound, multi-source, empirical