A DeFi protocol is a piece of software holding other people’s money. We checked how many of them are still being written. Across 217 protocols with at least $1 million deposited, 44.2% have not pushed a single public commit in 90 days, and a quarter have been silent for more than a year.
Key findings
- 44.2% of 217 DeFi protocols holding at least $1 million had not pushed a public GitHub commit in 90 days, and 25.3% had been silent for more than a year (DefiLlama and GitHub API data, 21 September 2026).
- The median DeFi protocol with at least $1 million deposited last pushed public code 52 days before 21 September 2026; only 32.3% of 217 protocols pushed anything in the previous week.
- Size predicts maintenance: DeFi protocols holding $1 million to $10 million went a median 108 days without a public push and 40% were silent for six months, against a median of 4 days and 10% silent among protocols holding over $100 million (217 protocols, September 2026).
- The 73 DeFi protocols with no public commit in 180 days hold $0.97 billion, 2.4% of the $40.2 billion in the sample of 217 protocols: a long tail of small pools, not a systemic hole.
- Caveat: only public repositories are counted, and an immutable contract needs no commits by design, so silence means no visible maintenance, not a dead protocol. Custodial wrappers such as WBTC and Robinhood are excluded.
A third of the field has been quiet for six months
We took every protocol in DefiLlama holding at least $1 million that lists a GitHub organisation, then read the last push date across its public repositories. The median protocol last shipped code 52 days ago. Only 32.3% pushed anything in the past week.
Before reading this as mass abandonment, the obvious objection deserves an answer, and it is a real one. In DeFi an immutable contract is a design goal, not neglect. A finished, audited, deliberately unchangeable contract needs no commits, and some of the quietest entries here are exactly that.
What the silence does tell you is narrower and still useful: if something breaks, there is no visible evidence that anyone is in a position to fix it. Frontends, SDKs and documentation are not immutable, and in a live project they move.
Money buys maintenance
The pattern by size is the cleanest result in the dataset.
Among protocols holding $1m to $10m, the median went 108 days without a push and 40% have been silent half a year. In the $100m-plus group the median is 4 days and only 10% are silent. Whatever else deposits buy, they buy someone to keep the lights on.
This also sets the scale honestly. The 73 silent protocols hold $0.97 billion between them, 2.4% of the $40.2 billion in our sample. This is not a systemic hole. It is a long tail of small pools that nobody is watching, which is a different and more ordinary problem.
The largest quiet ones
Team Finance, a token locker holding $46 million, last pushed to its public interface repository 1,902 days ago. AILayer farm, $80 million, has been quiet for 876 days. Vesper, a yield aggregator with $92 million, last touched its contracts repository 403 days ago.
We are deliberately not calling these protocols dead. Several are plainly operating. The claim is only what the record shows: no public commit in that window.
Why this matters
Due diligence in DeFi is usually framed around audits, and an audit is a snapshot of code at a moment. Commit history is the cheaper and more current question: is anyone still here? It takes thirty seconds to check on any protocol you are about to deposit into, and for two out of five protocols in this sample, the honest answer today is no.
Download the data (CSV)
defi-protocol-dev-activity-2026.csv: one row per protocol (217), as of 21 September 2026. Columns: protocol, GitHub organisation, category, chain, deposits (TVL) in USD, number of public non-fork non-archived repositories, date of the latest public push, and days since that push on 21 September 2026. Free to use and cite under CC BY 4.0 with attribution to BullpenBrief and a link to this page.
Methodology
Sources are the DefiLlama protocols endpoint and the GitHub REST API, retrieved 21 September 2026. We started from 247 protocols that hold at least $1 million and publish a GitHub organisation, resolved each organisation’s public repositories sorted by push date, and took the most recent push across repositories that are neither archived nor forks. That leaves 217 protocols after exclusions.
Exclusions matter here, so they are explicit. We dropped custodial and wrapper categories, along with Robinhood and WBTC by name. In the unfiltered run those two alone accounted for 93% of the “idle” deposits, which would have produced a headline about $24.7 billion sitting in unmaintained code. Robinhood’s deposits are customer assets and its product is not developed in that organisation; WBTC is a deliberately static wrapper. Including them would have been wrong for this question, and the corrected figure is $0.97 billion.
Two limits worth stating. Public repositories only: a team developing privately would look silent here, and for the larger names that is a genuine possibility. And the mapping from protocol to GitHub organisation comes from DefiLlama, so a protocol listing a stale organisation would be misread. We verified the organisations behind the named examples and they are the protocols’ own contract and interface repositories. Figures, charts and methodology are free to cite with attribution to BullpenBrief.
