How Stream Finance and Elixir Turned $1.9 Million Into a $14 Million Stablecoin Illusion

A stablecoin backed by a second stablecoin, which is in turn backed by the first, is not a novel financial primitive — it is an expensive loop that eventually has to be paid for by someone. That, according to on-chain investigators, is what Stream Finance (xUSD) and Elixir Network (deUSD) had quietly constructed: a cycle of minting, borrowing, bridging and re-minting that let a small pool of capital masquerade as a much larger one.

Researcher Schlagonia's analysis alleges that roughly $1.9 million in real capital was used to generate $14.5 million worth of xUSD — a multiplier that recalls Terra's collapse, dressed up in the vocabulary of "market-neutral strategies" and "delta-neutral positions."

By late October 2025, the paper trail was public: wallet transfers, transaction hashes, and confirmation that Hyperithm, a yield manager overseeing the mHYPER vault, had quietly withdrawn all of its exposure to the ecosystem, pulling roughly $10 million in user funds out before the situation became widely known. While depositors were still drawn in by yields advertised as high as 95% APY, more sophisticated players were already mapping their exit.

The uncomfortable question that followed: if a "stable" asset needs an insurance fund, a proof-of-reserves report that remains "coming soon", and institutional partners quietly heading for the door, in what sense is it actually stable?

Sources and reporting credited throughout: Schlagonia, Hyperithm, 0xlaw, Stream Protocol, Elixir, CBB, Inverse Finance, Omer Goldberg, and DCF God.

01Institutional framing, retail money

Neither project marketed itself with the usual cartoonish crypto branding. Stream described its operations in the register of a trading desk — a "market-neutral fund" running "lending arbitrages" and "hedged top of book market making." Elixir positioned deUSD as "DeFi's only dollar serving as rails for institutional assets," claiming backing from staked Ethereum and U.S. Treasury bills and citing partnerships tied to BlackRock's BUIDL fund and Hamilton Lane. Both protocols leaned heavily on the appearance of institutional legitimacy.

Stream's stated method for generating yield was "market neutral strategies" achieved through lending arbitrage and incentive farming, per its own site. Elixir's yield, according to third-party explainers, came from perpetual funding rate arbitrage. Combined, the pitch to retail was straightforward: institutional-grade returns without the usual institutional gatekeeping — delta-neutral, fully collateralized, transparent, safe.

That framing held up only as long as nobody examined the mechanics behind it. Stream retained direct minting authority over xUSD through its StreamVault contract. Elixir similarly controlled the backing mechanism for deUSD internally. Both promised transparency they had not delivered: Stream's proof-of-reserves page has stated "coming soon" indefinitely, while Elixir's own documentation acknowledges that deUSD "is not pegged to USD through a 1:1 reserve" and that "there is no centralized issuer holding real-world assets to support it." Few depositors appear to have read that fine print closely enough to recognize what it implied.

02Mapping the loop

On October 28, Schlagonia began publishing a step-by-step breakdown of what looked like a self-reinforcing minting cycle, backed by on-chain transaction data.

The cycle starts with USDC arriving in Stream's xUSD wallet, deposited by users who believe they are entering a conservative yield product.

Stage one — the swap. Stream moves the USDC to a secondary wallet, places a CoW Protocol order to acquire USDT, and then uses Elixir's on-chain minter to produce deUSD. That deUSD is then routed back to Stream's primary wallet — on its own, unremarkable DeFi activity.

Stage two — leveraging up. The deUSD is bridged to a chain with sdeUSD lending markets, such as Avalanche or World Chain, where stablecoins are borrowed against it as collateral. Those borrowed stablecoins are swapped back into USDC and bridged back to Ethereum mainnet, and the cycle repeats. On October 28 alone, three rounds of this loop generated roughly $10 million in deUSD from the original deposit. This much, on its own, is not unusual — leveraged looping is standard practice across DeFi lending markets like Aave.

Stage three — the twist. Where a conventional leverage loop would leave collateral parked and earning yield, Stream's version terminates in self-minting: the final tranche of borrowed USDC is used to mint Stream's own xUSD token. By this accounting, the same $1.9 million reportedly produced $14.5 million in xUSD. Schlagonia's research further estimates that if Stream indeed controls around 60% of xUSD's circulating supply — a figure that remains unconfirmed but is consistent with the token's thin trading and low volume — actual collateral backing each xUSD would sit near $0.40, and potentially below $0.10 if measured strictly across direct backing rather than protocol-owned liquidity.

Stage four — closing the circle. The newly acquired $10 million in USDT does not sit idle either. Elixir moves it into what its own Transparency Dashboard labels "Elixir's sUSDS Multisig," then swaps a portion of the USDT for USDC via CoW Protocol and bridges the proceeds to the Plume network, where the USDC is supplied directly into a Morpho lending market that accepts xUSD as collateral. The pattern repeats across multiple transactions.

According to Schlagonia, this particular market does not surface on standard Morpho interfaces — a consequence of Morpho's permissionless design, which lets anyone spin up isolated lending pools with bespoke parameters. The alleged figures for this pool: roughly $70 million in USDC supplied, more than $65 million borrowed, with Elixir as the sole depositor. Stream then borrows against the xUSD it just minted, bridges back to mainnet, and restarts the cycle: USDC becomes deUSD, deUSD collateralizes a USDC loan, that USDC mints more xUSD, and xUSD collateralizes yet another USDC loan used to mint more deUSD.

The net effect, as Schlagonia frames it, is that Stream and Elixir are not backing two independent dollar-pegged assets — they are circulating the same pool of USDC between each other while marketing it as two separate reserves. The arrangement functions only as long as no one tries to redeem everything at once. Over a single day, three loop iterations reportedly produced $10 million in new deUSD and more than $14 million in new xUSD, against under $2 million of genuine underlying capital — all traceable on-chain to anyone willing to look.

03Ignored warnings

The warning signs predate Schlagonia's thread by months, and multiplied sharply once it was published.

On October 28, crypto commentator CBB urged followers to pull funds: "If you have money on Morpho or Euler, withdraw from vaults with mHYPER and xUSD exposure. This is max opacity finance. The level of leverage from xUSD is insanity."

Market data reinforced the concern. xUSD had been trading between $1.20 and $1.29, well above its intended dollar peg, a pattern consistent with constrained, potentially manipulated supply. deUSD's daily trading volume regularly sat below $100,000 — thin liquidity for an asset marketed as a $160 million stablecoin.

The risks were not purely theoretical. In May 2025, a Chainlink oracle malfunction triggered more than $500,000 in liquidations for deUSD users on Avalanche's Euler Finance. In August, deUSD touched an all-time low of $0.9831, a roughly 1.7% de-peg — modest in isolation, but notable for an asset whose entire value proposition rests on holding par. That same month, Inverse Finance's community governance voted to sunset its deUSD markets entirely, citing "risk and operational concerns" — a protocol formally declining to accept the asset as collateral.

Despite the accumulating red flags, deposits continued.

04The wider contagion

Stream and Elixir were not operating in isolation. On October 26, analyst Togbe began tracing how the risk extended into YieldFi's yUSD. YieldFi's largest position was a deposit in a Morpho vault called ABRC, specifically the yUSD/USDC market, where borrowers were leveraging yUSD across several lending venues. Its second-largest position was in mHYPER — already producing negative returns — with YieldFi accounting for more than 10% of that vault's total value locked. On Arbitrum, mHYPER was in turn lending against yUSD, and its second-largest allocation was Stream's xUSD.

The resulting structure formed a closed loop: Stream mints xUSD and Elixir mints deUSD, both flow into Morpho and Euler lending markets, yUSD borrows from those same markets while also serving as collateral for mHYPER, and mHYPER lends back into the same ecosystem — meaning each protocol's solvency depended on the others'. Once that structure became visible, 24% of yUSD's market capitalization disappeared within 24 hours while its team offered no public comment.

The most consequential reaction came on October 28, when Hyperithm, which runs the mHYPER vault, published a statement acknowledging the situation. The firm — founded by people recognized on Forbes' 30 Under 30 list and operating out of Tokyo and Seoul — framed its response as "full transparency," and detailed concrete steps: removing all yUSD exposure, removing all xUSD exposure, standing up dedicated non-recursive lending vaults on Morpho and Euler, and targeting full liquidity migration within the following week. It disclosed that it retained $10 million in unleveraged mHYPER positions as a general-partner commitment, framing this as evidence it was repositioning rather than fleeing outright, and published wallet addresses for public verification: 0x7C1d52A3459f2Eee78DA551b8C3D13FdF61fbc93 and 0xEa036F911b312BC0E98131016D243C745d14D816.

The underlying logic of that exit is straightforward: once borrowing costs spike or liquidity dries up, a recursive loop stops being profitable and unwinds — and when it does, liquidations can cascade through every connected protocol simultaneously, since markets that appear isolated on Morpho's permissionless architecture are, in this case, deeply interlinked. Euler, still recovering reputationally from May's oracle incident, had exposure across multiple layers of this same web: xUSD-backed lending, itself backed by deUSD, which collateralized yUSD, which funded mHYPER, which lent back into the same markets. Retail depositors in those vaults were several steps removed from the recursive mint loop and largely unaware of how exposed they were to its unwinding.

05Competing defenses

As scrutiny intensified, two very different defenses emerged from people close to the situation.

Investor DCF God, who disclosed a personal stake in Klyra — a firm that holds a stake in Stream — argued that xUSD's structure was reckless but not fraudulent. His reasoning: if a token pays out X APR and a user can borrow against it at 0.5X APR (or even 0.95X, factoring in points programs or side incentives), rational capital will loop it aggressively. As he put it, "if the curators or other lenders are willing to lend 10M of usdc against xusd, they can inhale all 10M with just 2M of deposits, and use the 10M to farm at much higher than their cost to borrow." He characterized this as a pursuit of "the highest possible yields for the business and vault depositors" rather than an attempt to game external metrics, concluding: "Risky levered degenerate potential for complete losses? Yes. Scam, not backed? No." He also acknowledged he would not personally recommend depositing in xUSD, even while holding a small position himself because "the farm is good," and noted that his own personal farms typically cap leverage around 5x out of practical caution about rate changes and unwind timing — while maintaining that Stream running much higher leverage was simply "their business," part of "the most degen farm," and that depositors should expect exactly that behavior. His broader philosophy: once a position is degen at all, incremental leverage between, say, 80% and 90% LTV barely changes the outcome if the underlying asset fails — so users might as well take the higher leverage.

Stream's own response, relayed by 0xlaw on October 28, took a different tack. The team claimed to maintain a $10 million insurance fund, stated that all activity outside its main wallet ran with "0 leverage involved and fully liquid immediately," and said user assets had been protected even while protocol-owned funds carried leverage, with no history of liquidation or exploit. It reiterated that proof-of-reserves reporting was still "coming soon," citing work with third-party providers toward 24-hour updates, and argued that publicly displaying positions in real time would undercut its trading edge given how quickly it had scaled. The statement then pivoted: citing negative sentiment on Twitter around protocol-owned liquidity holding leveraged positions — insisting this had "been transparent from day 1" — Stream said it would wind those positions down and cap them relative to the size of its insurance fund.

That combination — describing something as having been transparent all along while simultaneously promising to unwind it — reads less like reassurance and more like an admission that the criticism had landed. "Coming soon" became attached to nearly every substantive claim: insurance fund composition, reserve verification, and any CEX insurance policies the protocol said it held. DCF God separately pointed to premarket liquidations in XPL as an illustration of how conservative positioning can still fail during systemic stress — traders holding 2x overcollateralization were liquidated hardest despite appearing to hold the "safest" positions on paper, since extra collateral does not help when the underlying assumptions of a system break down.

Neither DCF God nor Stream disputed that the recursive minting had occurred. The disagreement was only over whether it mattered.

06Where it leaves the ecosystem

Nothing about this event stems from a smart-contract bug: the contracts reportedly executed exactly as written, and both protocols remained technically functional throughout. The issue is one of disclosure rather than code — Stream is alleged to control around 60% of xUSD's supply, the recursive loop is alleged to have converted $1.9 million into roughly $14 million in tokens, and proof-of-reserves documentation has remained pending indefinitely. Marketing that structure as "institutional-grade" is, at minimum, a significant overstatement of its safety.

Hyperithm's on-chain analysis prompted it to withdraw $10 million before the broader picture became public; most other depositors lacked the visibility or expertise to make the same call in time. The episode underscores a recurring pattern in DeFi: systems can be technically trustless while still being functionally opaque, with the gap between the two closing only after informed participants have already repositioned.