$93 Million Casually Misappropriated? The Truth Behind the Stream Finance Collapse

marsbitPublished on 2025-12-17Last updated on 2025-12-17

Abstract

Stream Finance, a DeFi yield protocol with over $200M TVL, collapsed on November 4, 2025, after announcing a $93M loss caused by an "external fund manager." Its stablecoin xUSD plummeted 77%, triggering a $285M contagion across lending protocols like Morpho and Euler, leading to a $1B DeFi outflow. Initially blamed on "Curator" risk managers, the truth emerged from a December 8 lawsuit: founder Caleb McMeans had transferred protocol control to trader Ryan DeMattia with "no formal relationship." On October 10, DeMattia’s personal leveraged positions were liquidated during an ETH crash, and he allegedly used Stream’s funds to cover his losses—weeks before the Balancer hack (November 3) was falsely cited as the cause. The disaster was amplified by xUSD’s recursive lending structure but rooted in unregulated, off-chain asset control without multisig or custody safeguards. The incident highlights DeFi’s vulnerability to opaque operations and personal misconduct, not systemic failure of Curator models or yield strategies.

November 4, 2025, marked a "Black Tuesday" for the DeFi world.

Stream Finance, a yield aggregation protocol with a TVL that once exceeded $200 million and was touted as "The SuperApp DeFi Deserves," suddenly announced that an "external fund manager" had caused approximately $93 million in losses, and all deposit and withdrawal functions were suspended effective immediately.

Upon the news, its issued "stablecoin" xUSD flash-crashed from $1 to $0.26, a 77% drop in 24 hours. More critically, xUSD was widely used as collateral in major lending protocols like Morpho, Euler, Silo, and Gearbox—one bomb detonated, causing severe shockwaves throughout the DeFi lending market.

According to statistics from DeFi research firm Yields And More (YAM), Stream-related debt exposure reached a staggering $285 million:

Elixir's deUSD, which had lent 65% of its reserves (about $68 million USDC) to Stream, directly announced its closure. Its price plummeted from $1 to $0.015, nearly zero.
Compound suspended its USDC/USDS/USDT markets.
Euler froze related liquidity pools.
Morpho incurred bad debt.

Within a week, the DeFi market saw a net outflow of about $1 billion. Some compared this to the "Terra moment of 2025," Aave founder Stani Kulechov even warned on social media: "The next Terra Luna might be brewing."

I happened to be researching Curator in depth recently, and because of the Stream Finance incident, Curator was pushed into the spotlight. So I looked into the sequence of events to help everyone understand the full picture as much as possible.

Scapegoat: How Did Curator End Up Taking the Blame?

After the incident, public criticism quickly pointed to one role: Curator.

How was this blame shifted? Looking back at Stream's official statement on November 4th, the loss was caused by an "external fund manager."

This wording easily brings to mind the Curator role in DeFi lending protocols like Morpho and Euler—those "curators" responsible for managing liquidity pools and setting risk parameters.

The chain reaction following Stream's collapse made this narrative seem even more "confirmed":

On November 6th, Lista DAO urgently initiated a governance vote to force liquidate Vaults managed by MEV Capital and Re7 Labs—borrowing rates had soared to 800%, and the borrowers showed no signs of repayment. Re7 Labs subsequently issued a statement admitting it had an exposure of about $14.65 million in its xUSD isolated vault on Euler.

Top Curators' Vaults collectively exploding, emergency votes for forced liquidation—wasn't this a Curator problem?

BlockBeats published a widely circulated article after the event titled "DeFi's Potential $8 Billion Bomb, Only $100 Million Has Exploded So Far," attributing the collapse to "external Curators using user funds for opaque off-chain transactions" and characterizing it as a "systemic crisis of the Curator model."

Meanwhile, another "coincidence" made things even more mysterious—just one day before Stream's collapse (November 3rd), Balancer was hacked, losing approximately $128 million.

Thus, the mainstream narrative became: Curators misappropriated client funds for high-risk strategies, invested in Balancer, Balancer got hacked, money was lost, the Curator model is unreliable.

But there's a key question here: Was Curator really the core cause behind Stream's collapse?

It wasn't until December 8th, when court documents were made public, that we got a glimpse of the full picture.

The Truth Emerges: A Different Story Revealed by Court Documents

On December 8th, Stream Trading Corp. (the original Stream founding team) filed a lawsuit in San Francisco Federal Court against Caleb McMeans (online alias 0xlaw) and Ryan DeMattia.

This lawsuit revealed a completely different story.

Project Handover: A "Acquisition" Without Cash

According to a detailed report by DL News on the court documents:

In February 2024, Argentine crypto investor Diogenes Casares founded the Stream Protocol. In April of the same year, the project completed a $1.5 million seed round led by Polychain, with a valuation of $20 million.

However, after just 9 months of operation, by November 2024, the founding team decided to shut down the project due to "operational challenges."

At that moment, trader Caleb McMeans appeared. He proposed acquiring Stream, presenting himself as an "expert in managing complex yield strategies."

In January 2025, both parties signed an agreement:

McMeans gained full control of the protocol, including all on-chain transactions, off-chain business agreements, and user deposit management rights.
In exchange, he would pay the original team a 35% fee share and promised to "fully transparently disclose the deployment locations of the funds."

Note: This was not a cash acquisition—McMeans did not pay money to buy the protocol but signed a "I operate, you get fees" agreement. The original team retained the role of service provider for the smart contracts, website, and token.

Out-of-Control Assets: $90+ Million Handed to Someone with "No Formal Relationship"

The problem arose after McMeans took over. According to the lawsuit, he handed over more than $90 million in protocol assets to a person named Ryan DeMattia for off-chain management.

Who is DeMattia? The lawsuit's description is quite subtle: McMeans initially called him an "employee" but later admitted to having "no formal relationship" with DeMattia.

No formal relationship, yet he gave this person control over $90+ million in off-chain assets. Outrageous?

It gets even more outrageous.

Laptop Destroyed in a Car Crash

In September 2025, the original founding team began demanding more transparency from McMeans, wanting to know where the funds were. McMeans' response was "continuous delays and excuses."

When the team pressed DeMattia, his response was even more spectacular—direct quote from the lawsuit:

"DeMattia offered a series of patently false excuses for why he could not provide any further information, even claiming at one point that his laptop had been destroyed in a car crash."

The creativity of this excuse is perhaps only matched by "my dog ate my homework."

The lawsuit continues, stating that McMeans at the time advised the original team to "stop asking questions and just trust DeMattia."

October 10th: Personal Liquidation, Misappropriation to Cover Losses

Then, October 10th arrived.

On that day, the price of ETH plummeted 21%, setting a record for the largest single-day liquidation in crypto history, with approximately $20 billion in positions liquidated. The lawsuit describes:

"But upon information and belief, on October 10, 2025, Mr. DeMattia faced a margin call on a personal loan for which he lacked sufficient funds to cover, had his position liquidated, and then used Stream Protocol assets to which he had access to cover his loss."

Translation: DeMattia's own leveraged position was liquidated, he didn't have money to cover the margin call, so he顺手 used Stream's money to fill the hole.

On November 2nd, DeMattia finally "confessed." According to DL News:

"On November 2, he admitted he had lost 'nearly all' of the Stream protocol assets under his control, which were worth about $93 million at the time."

Timeline Mismatch: Balancer Was Just a Smokescreen

Please note this date: November 2nd.

When was Balancer hacked? November 3rd.

If Stream's $93 million was lost in the Balancer hack, the loss should have occurred on November 3rd. But DeMattia admitted on November 2nd that it was "all lost"—the timeline doesn't match.

More crucial evidence: The lawsuit points out that McMeans deleted "all private Discord communication records with DeMattia since October 10th"—exactly the day DeMattia is believed to have started misappropriating funds.

If the loss was truly due to an external event like the Balancer hack, why delete chat records starting from October 10th?

The answer becomes clear: The Balancer hack was likely just a "convenient coincidence," used to divert attention, confuse the timeline, and provide a "force majeure" smokescreen for internal misappropriation.

BlockEden's analysis report also corroborates this: "No evidence of a smart contract hack or exploit has been found."

Essence: Personal Misappropriation, Amateurish Operation

So, was this collapse caused by a systemic failure of the Curator model, or blatant amateurish behavior leading to personal misappropriation of assets?

The lawsuit provides a clear answer: This was personal misappropriation.

DeMattia was not a professional Curator institution; he was an off-chain trader privately hired by McMeans, with "no formal relationship" to the protocol. He was given actual control over $90+ million, with no custody segregation, no multi-signature protection, no on-chain verifiability—when his personal position was liquidated, he directly used users' money to fill his own hole.

The Amplifier: How xUSD Recursive Lending Blew the Hole Wider

This personal misappropriation led to a collapse that, due to xUSD's recursive lending strategy, blew a $285 million hole.

If Stream were just a simple custody protocol, DeMattia misappropriating $93 million would have resulted in at most a $93 million loss. But because xUSD was designed to be a "yield-enhanced stablecoin" that could circulate, be used as collateral, and be re-borrowed across various protocols, this $93 million hole spread like a virus through DeFi's composability, infecting the entire ecosystem.

Recursive lending was not the cause of the disaster, but it was the amplifier of its scale.

Yearn developer Schlag had warned before the collapse: "Using the same 1.9 million USDC, they minted about 14.5 million xUSD"—a 7.6x capital amplification. When the underlying assets failed, this multiplier became an accelerator of destruction.

When the underlying assets (the $93 million held by Stream) disappeared, the entire recursive lending structure instantly collapsed, inflating the debt exposure from $93 million to $285 million.

Conclusion: Review, Reflection, and the Future

Let's梳理 (organize) the complete chain of this collapse:

Starting Point: The Stream Finance project "sold" the protocol to trader McMeans, who then handed $93 million in user assets to DeMattia, with whom he had "no formal relationship," for off-chain management.

Trigger: ETH price crashed on October 10th, DeMattia's personal position was liquidated, and he directly misappropriated Stream's funds to cover his losses.

Amplifier: The xUSD recursive lending structure amplified the $93 million hole into a $285 million debt exposure, infecting the entire DeFi lending market.

Smokescreen: Balancer was hacked for $128 million on November 3rd, becoming the perfect excuse to divert attention—even though DeMattia had already admitted the loss on November 2nd.

Scapegoat: Public opinion pointed the finger at the Curator model, ignoring the real problem of personal misappropriation.

What is the essence of this collapse?

Not a failure of the Curator model

In protocols like Morpho and Euler, Curators have defined boundaries—they can set risk parameters, adjust collateral ratios, decide which assets to accept, but cannot directly transfer user funds. User assets deposited into Vaults are locked in smart contracts; Curators cannot move them.

The problem with the Curators pushed into the spotlight was "negligence": accepting problematic assets like xUSD as collateral without conducting thorough due diligence.

Not the original sin of recursive lending strategy

Recursive borrowing itself is just a tool to amplify returns and risks. Used well, it's efficient capital operation; used poorly, it's suicidal leverage. Stream's recursive lending amplified the scale of the disaster but was not its cause.

The real problem is: One person could control tens of millions of user assets without any constraints

No custody segregation
No multi-signature protection
No on-chain verifiable fund flow
No compliance audits whatsoever
Not even a formal employment contract

This is the most primitive betrayal of trust—handing money to a person, and that person taking it away.

This is also the current state of the DeFi industry: Amateurish operations are rampant, and regulation is absent. A DeFi protocol can be casually "transferred," user funds can be casually misappropriated, and there are no real institutional constraints at any step of the entire process.

But crisis often breeds turning points.

The Stream collapse is forcing the industry to mature. As regulatory frameworks and legislation continue to be refined and implemented, more transparent, compliant, and professional protocols and service providers represent the real future opportunity for this industry.

References:

DL News: "Stream Finance founders sue business partner, allege $93m used to cover personal losses"https://www.dlnews.com/articles/defi/stream-finance-founders-sue-partner-over-alleged-93m-loss/
The Defiant: "Stream Files Lawsuit Against Operator '0xlaw' Over $93 Million Loss"https://thedefiant.io/news/defi/stream-finance-files-lawsuit-against-0xlaw-mcmeans
The Defiant: "How Stream Finance's Collapse Exposed DeFi's Looping Yield Bubble"https://thedefiant.io/news/defi/how-stream-finance-s-collapse-exposed-defi-s-looping-yield-bubble
Lawsuit Case: Stream Trading Corp. v. McMeans, Case No. 3:25-cv-10524, U.S. District Court for the Northern District of California, filed December 8, 2025
BlockEden: "Anatomy of a $285M DeFi Contagion: The Stream Finance xUSD Collapse"https://blockeden.xyz/blog/2025/11/08/m-defi-contagion/
Tiger Research: "Collapse of the Defi Jenga: The Stream Finance Breakdown"https://reports.tiger-research.com/p/collapse-of-the-defi-jenga-the-stream-eng
The Block: "Analysts map $285M in potential exposure across DeFi after Stream Finance's $93M loss"https://www.theblock.co/post/377491/analysts-map-285m-in-potential-exposure-across-defi-after-stream-finances-93m-loss
BlockBeats: "DeFi's Potential $8 Billion Bomb, Only $100 Million Has Exploded So Far" (《DeFi潜在80亿美金的雷,现在只爆了1个亿》)
Yields And More (YAM): Stream Finance Debt Exposure Analysis
Re7 Labs: Statement on Stream Finance Insolvency and xUSD Exposurehttps://x.com/Re7Labs/status/1985694621251387506

Codex Goal Mode Usage Guide: How to Make AI Continuously Pursue a Specific Objective

"Codex Goal Mode: How to Make AI Work Continuously Toward a Specific Goal" OpenAI's Codex "goal mode" (/goal) transforms the AI from a reactive code assistant into a proactive execution agent capable of working autonomously for hours or even days to achieve a defined objective. To maximize its effectiveness, follow these key principles: 1. **Define Clear, Verifiable Exit Criteria:** The goal prompt should be a concise, measurable success condition, not a lengthy specification. Use quantifiable metrics like "reduce build time by 30%" or "achieve 100% test parity." 2. **Provide Initial Guidance and Tools:** Direct Codex toward likely problem areas and specify available tools (e.g., browsers, testing environments) to prevent it from exploring unproductive paths. 3. **Enable Progress Measurement:** Equip Codex with ways to track advancement, such as creating comparison tools for visual tasks or evaluation sets, ensuring it can gauge its own progress. 4. **Use a Realistic Execution Environment:** For tasks like performance optimization, provide access to environments that closely mimic production (e.g., similar configs, databases) to yield valid results. 5. **Be Cautious with Visual Goals:** Avoid vague "pixel-perfect" instructions. Instead, supplement visual references with functional checklists or design system specifications to prevent Codex from obsessing over minor details. 6. **Implement Progress Tracking:** For long-running tasks, have Codex commit code to draft PRs, update progress documents, or send Slack updates to maintain visibility into its work. 7. **Review and Consolidate Results:** Once the goal is met, instruct Codex to review its work, clean up ineffective experimental code, and reflect on what strategies succeeded or failed. Ultimately, using goal mode shifts the developer's role from writing prompts to managing a persistent engineering agent—defining objectives, establishing metrics, configuring environments, and conducting final reviews.

marsbit49m ago

Codex Goal Mode Usage Guide: How to Make AI Continuously Pursue a Specific Objective

marsbit49m ago

From Ethereum to AI's 'CROPS': What Exactly Is This 'Slow Variable' That Vitalik Has Repeatedly Emphasized?

Recently, Vitalik Buterin has frequently emphasized the concept of "CROPS," first outlined in the Ethereum Foundation's March mandate as core principles guiding its focus: Censorship Resistance, Capture Resistance, Open Source, Privacy, and Security. CROPS represents Ethereum's commitment to providing foundational capabilities for user sovereignty—enabling asset ownership, identity expression, and coordination without reliance on centralized platforms or surrendering ultimate control. This framework is gaining new urgency with the rise of AI, particularly AI agents managing digital assets and automating transactions. While AI offers convenience, it risks centralizing user data, intent, and control if dependent on opaque, centralized services. Vitalik argues for "CROPS AI"—AI that is open, privacy-preserving, secure, and capable of local execution to maintain user agency. He highlights convergence between "CROPS Ethereum access layers" and "CROPS AI," such as using zero-knowledge proofs for private remote LLM calls and Ethereum RPC reads, ensuring users can access services without exposing sensitive information. Ultimately, CROPS is not just an abstract ideal but a practical guide for Ethereum's development and AI integration. It addresses the critical long-term question: as digital systems grow more powerful, how can users retain control over their privacy, assets, and autonomy? In an AI-driven era, these principles may define Ethereum's enduring value—prioritizing verifiable, secure, and user-centric design over short-term optimizations like speed and cost alone.

marsbit53m ago

From Ethereum to AI's 'CROPS': What Exactly Is This 'Slow Variable' That Vitalik Has Repeatedly Emphasized?

marsbit53m ago

Forget Bitcoin, What Does Gold Have To Do With The Altcoin Season?

The article suggests that the timing of the next altcoin season may be signaled by gold's price action rather than traditional crypto market metrics. An analyst predicts gold will stage a bear market rally to around $4,800 before resuming a downward correction. This rally could trigger a FOMO-driven surge in altcoins, followed by a sharp correction and a sentiment capitulation—which would then mark the true beginning of the altcoin season. Meanwhile, the total crypto market cap excluding stablecoins is testing a long-term rising support trendline, indicating a potential foundational level for future expansion. The convergence of these factors implies the market may need one final emotional flush before a sustained altcoin season can commence.

bitcoinist58m ago

Forget Bitcoin, What Does Gold Have To Do With The Altcoin Season?

bitcoinist58m ago

Coinbase–Better Deal Enables Mortgages Secured By Bitcoin And USDC

Better Mortgage, in partnership with Coinbase, is launching a U.S. home loan product that accepts Bitcoin and USDC as collateral, with a nationwide rollout planned for summer 2026. The first loan has already been issued to a couple in Michigan. A key distinction from earlier crypto-backed loans is the involvement of Fannie Mae, which provides a conforming guarantee, effectively treating digital assets as valid collateral. The product also differs by not subjecting the crypto collateral to liquidation if its value declines; the assets remain in custody for the loan's entire term. Better projects an initial loan volume of $250 million based on early sign-ups and plans to expand to other digital assets like tokenized stocks.

bitcoinist1h ago

Coinbase–Better Deal Enables Mortgages Secured By Bitcoin And USDC

bitcoinist1h ago

Tom Lee Still Predicts ETH Will Reach $250,000. Do You Still Believe?

Tom Lee, Chairman of Bitmine and Head of Research at Fundstrat, predicts Ethereum (ETH) could reach $250,000, driven by AI and tokenization transforming financial infrastructure. Speaking at the Paris Proof of Talk conference, he argued that a machine-to-machine economy will require fast, blockchain-based payments, positioning ETH as a primary global currency for automated computation. Lee highlighted Bitmine's recent purchase of 111,942 ETH, bringing its holdings to nearly 5.4 million ETH, or about 4.47% of circulating supply. He noted the Ethereum Foundation's declining influence (now holding only 0.1% of supply) is being replaced by corporate validators like Bitmine, which generate significant staking rewards. Lee also announced Bitmine qualifies for inclusion in the Russell 1000 index, seeing its staking model as superior to holding spot ETH. He views current bearish sentiment as a market bottom for both Bitcoin and Ethereum.

Foresight News2h ago

Tom Lee Still Predicts ETH Will Reach $250,000. Do You Still Believe?

Foresight News2h ago

Trading

Spot

Futures

Hot Articles

How to Buy SFP

Welcome to HTX.com! We've made purchasing SafePal (SFP) simple and convenient. Follow our step-by-step guide to embark on your crypto journey.Step 1: Create Your HTX AccountUse your email or phone number to sign up for a free account on HTX. Experience a hassle-free registration journey and unlock all features.Get My AccountStep 2: Go to Buy Crypto and Choose Your Payment MethodCredit/Debit Card: Use your Visa or Mastercard to buy SafePal (SFP) instantly.Balance: Use funds from your HTX account balance to trade seamlessly.Third Parties: We've added popular payment methods such as Google Pay and Apple Pay to enhance convenience.P2P: Trade directly with other users on HTX.Over-the-Counter (OTC): We offer tailor-made services and competitive exchange rates for traders.Step 3: Store Your SafePal (SFP)After purchasing your SafePal (SFP), store it in your HTX account. Alternatively, you can send it elsewhere via blockchain transfer or use it to trade other cryptocurrencies.Step 4: Trade SafePal (SFP)Easily trade SafePal (SFP) on HTX's spot market. Simply access your account, select your trading pair, execute your trades, and monitor in real-time. We offer a user-friendly experience for both beginners and seasoned traders.

667 Total ViewsPublished 2026.05.22Updated 2026.06.02

How to Buy CTR

Welcome to HTX.com! We've made purchasing Citrea (CTR) simple and convenient. Follow our step-by-step guide to embark on your crypto journey.Step 1: Create Your HTX AccountUse your email or phone number to sign up for a free account on HTX. Experience a hassle-free registration journey and unlock all features.Get My AccountStep 2: Go to Buy Crypto and Choose Your Payment MethodCredit/Debit Card: Use your Visa or Mastercard to buy Citrea (CTR) instantly.Balance: Use funds from your HTX account balance to trade seamlessly.Third Parties: We've added popular payment methods such as Google Pay and Apple Pay to enhance convenience.P2P: Trade directly with other users on HTX.Over-the-Counter (OTC): We offer tailor-made services and competitive exchange rates for traders.Step 3: Store Your Citrea (CTR)After purchasing your Citrea (CTR), store it in your HTX account. Alternatively, you can send it elsewhere via blockchain transfer or use it to trade other cryptocurrencies.Step 4: Trade Citrea (CTR)Easily trade Citrea (CTR) on HTX's spot market. Simply access your account, select your trading pair, execute your trades, and monitor in real-time. We offer a user-friendly experience for both beginners and seasoned traders.

535 Total ViewsPublished 2026.05.25Updated 2026.06.02

What is USOIL

USOILUSDT Perpetual Contract is the trading symbol for West Texas Intermediate (WTI) Crude Oil priced in US dollars, representing 1 barrel of crude oil.

536 Total ViewsPublished 2026.05.25Updated 2026.05.25

Discussions

Welcome to the HTX Community. Here, you can stay informed about the latest platform developments and gain access to professional market insights. Users' opinions on the price of A (A) are presented below.