DeFi Yield's Missing Piece: Inside Firelight's Cover Model
When an underlying protocol gets hacked, depositors absorb the loss. Firelight, a cover protocol on Flare incubated by Sentora, pays out to vaults when a protocol they deposit into is exploited, using capital XRP stakers lock up in exchange for fees.
Firelight
Introduction
Over the past year, more and more DeFi yield has been reaching users not through DeFi apps themselves, but through the “Earn” products of exchanges, wallets, and fintechs. The idea is simple - a user deposits with a few taps, and the platform routes that money into onchain vaults behind the scenes. Kraken’s DeFi Earn, for example, runs on Veda vaults with Sentora designing the strategies, while Coinbase offers USDC vaults on Morpho that are curated by Steakhouse. Even traditional asset managers like Bitwise have started curating Morpho vaults of their own. For the user, all of this shows up as a balance and a yield. What they don’t see is everything underneath it - the lending markets, collateral, price feeds, and liquidation engines that produce that yield in the first place.
The data shows just how much money is flowing this way. DefiLlama’s risk curators category, which tracks the firms that run these vaults, now holds $9.55 billion of TVL across 96 protocols - 26% more than it did in September 2025. What makes that number stand out is the backdrop: over the same period, lending TVL fell 39% and yield aggregators fell 74%.
That said, one problem still holds exchanges, fintechs, and institutions back from selling DeFi yield at full scale: when an underlying protocol gets hacked, depositors absorb the loss. Good curation can lower the odds of that happening, but it can never bring them to zero, and the capital sitting behind onchain cover today is tiny. If we leave out Firelight, the protocol this report covers, cover-backing capital comes to about 0.13% of DeFi TVL, or roughly $1.25 for every $1,000 deposited.
Firelight is a cover protocol on Flare, incubated by Sentora, that works at the vault level: stakers lock up XRP-backed capital behind a defined set of protocol failures and earn fees in return. It went live on October 6, 2026, with its first cover applied to two Sentora vaults, and on October 15, it announced cover on Kraken Protected Strategies USDC, a vault on Kraken DeFi Earn. Its first 30-day period closed with $38.0 million of active cover. In the second period, which began on November 5, Lido Earn added $14.7 million of cover on its EarnETH and EarnUSD vaults, bringing the total to $51.2 million.
In this report, we’ll walk through how vault-based Earn products grew, why protection is the piece that’s still missing, how Firelight works, what its early numbers look like, and what cover on Kraken could mean for other exchange Earn products.
Earn is where DeFi yield is scaling
Distribution and curation are now separate jobs
Most embedded yield products today are put together in roughly the same way, and the easiest way to think about them is in two layers. The first is distribution - the exchange, wallet, or fintech that owns the customer relationship and the app they use, like Kraken or Coinbase. The second is curation - the risk manager that decides which markets the vault goes into and how much risk it takes on, like Sentora, Steakhouse, or Gauntlet. The vault contracts sitting underneath vary from platform to platform (Kraken’s run on Veda, while Coinbase’s run on Morpho), but comparing them is outside the scope of this report.
Paul Frambot, co-founder and CEO of Morpho, explained this split to The Block back in January: exchanges like Coinbase focus on distribution and the user experience and don’t manage onchain strategies themselves, while the vaults need a curator to design the strategy, manage risk, and allocate capital. In other words, the exchange brings in the customers, and the curator decides what happens to their money.
Of the four categories in the chart, curation is the only one that’s bigger today than it was a year ago. Indexed to 100 in September 2025, risk curators now sit at 126, compared with 61 for lending, 26 for yield aggregators, and 77 for insurance. It hasn’t been a smooth ride either - curator TVL spiked to $11.2 billion in October 2025 and then fell to $5.7 billion by December - but it has climbed back steadily since, and is now up 60% from its April 2026 low of $6.0 billion.
The line we’d pay the most attention to, though, is insurance. The capital that backs onchain cover is now below where it started, even as the capital it’s meant to protect has grown. So money is moving into curated vaults much faster than protection is following it - and that gap is what the rest of this report is about.
Sentora and Steakhouse are neck-and-neck at the top
At the top, vault curation has turned into a two-horse race. Steakhouse Financial and Sentora each hold about 26% of risk-curator TVL, and the gap between them is less than half a percent ($2.53 billion against $2.52 billion). Gauntlet adds another 17%, which means the top three together hold 70% of the category. After that the field thins out quickly - Nonce Capital, the fourth-largest curator, holds only about a quarter of Sentora’s TVL.
Where the two leaders really differ is momentum. Over the last 30 days, Sentora’s TVL grew 26% while Steakhouse’s shrank 18%, and over 90 days the difference is even starker, with Sentora up 49% against Steakhouse’s 8%. Steakhouse did earn more in fees over the past month ($7.7 million versus Sentora’s $6.2 million), so it isn’t a one-sided picture. But while Steakhouse holds the top spot today by a sliver, the money has clearly been moving towards Sentora.
Kraken shows the model working at scale
Kraken launched DeFi Earn on January 26, 2026, on top of Veda’s infrastructure. It started with three USDC vaults allocating to venues like Aave, Morpho, Sky, and Tydro, then added a Bitcoin vault in May; in September, Sentora also launched tokenized-equity vaults on Kraken. As of July, Sentora is the strategy designer across all four vaults in the program, according to its own case study. One of those vaults, Boosted USDC, has since been renamed Kraken Protected Strategies USDC, and on October 15 it became the first Kraken vault to carry Firelight cover. Depositors still put money into the Kraken vault directly. The cover sits behind it, drawn from a single Firelight vault of staked FXRP that also backs the Sentora USD Protected Vault and the Sentora Protected RWA Vaults — more on that in Section 5.
The program has grown fast. By May 27, about four months in, Sentora reported roughly $250 million in deposits from nearly 50,000 depositors. Its case study, dated July 2026, put the program at $611 million across more than 80,000 depositors - led by the Bitcoin vault at more than $320 million and the Advanced Strategies USDC vault at more than $240 million - with what Sentora describes as a $0 liquidation record. And by September, Sentora said deposits had passed $800 million. DefiLlama’s own data tells a similar story: Sentora’s curated TVL on Ink, Kraken’s layer-2 network, now sits at $885 million, or about 35% of its total.
For the purposes of this report, Kraken matters for one main reason: it shows the whole stack working end to end, with distribution and curation running together on real money and tens of thousands of retail depositors. What it didn’t have, until this month, was any kind of protection layer. Sentora’s own xStocks launch note is upfront about this, pointing out that neither Sentora nor Kraken controls the third-party protocols underneath. So if one of the venues a vault allocates to gets exploited, that loss flows straight through to depositors.
Every vault carries risk the depositor can’t see
Credit and real-world-asset collateral aren’t new to curated vaults. What Sentora’s Protected RWA Vaults do differently is pull that exposure out into a vault of its own, one that carries higher risk and pays a higher return than a plain stablecoin vault. Flare describes them as running strategies on tokenized assets that include leveraged looping and lending in markets that accept RWAs as collateral. Sentora’s tokenized-equity vaults on Kraken work along similar lines - they post stocks such as SPYx, QQQx, and NVDAx as collateral and borrow against them, which brings in liquidation and oracle risk whenever stock markets are closed.
Once higher-risk exposure sits in a vault of its own, it becomes a lot easier to pin down what could go wrong and who’s carrying that risk. That’s exactly where cover is aimed first - one of the two products Firelight launched with is Sentora’s Protected RWA Vaults. But it isn’t only RWA vaults. Every one of these products, from a leveraged RWA strategy to a plain USDC vault on Kraken, is a stack of lending markets, oracles, and bridges that the depositor never sees, and that’s the exposure cover is built to pick up - which is why Firelight’s cover has now reached Kraken’s Protected Strategies USDC vault as well.
Losses still dwarf the capital behind cover
Protocol hacks haven’t slowed down
Losses aren’t slowing down. According to DefiLlama’s hacks database, DeFi protocols alone have lost $1.18 billion to hacks so far in 2026 - already more than in any of 2023, 2024, or 2025, with ten weeks of the year still left to go. Over the last twelve months, protocols were hit 243 times for a total of $1.35 billion, and this is the part of the problem that cover can actually address. A further $587 million was lost to exchange hot-wallet thefts and wallet compromises, but those sit outside what vault-level cover is designed for.
If you look at the biggest protocol losses of the past year and a half, most of them have something in common: they were code, upgrade, or accounting failures, the kind of thing a vault depositor has no real way of seeing coming. Drift lost $295 million in April 2026 to an access-control failure through a hijacked proxy upgrade, and Kelp lost $293 million that same month to cross-chain message spoofing. In August 2026, Tectonic lost $124 million to a donation attack on its share accounting. Going further back, Cetus lost $223 million to an arithmetic error in May 2025, and Balancer v2 lost $128 million to a rounding error in November 2025.
How thin cover has been until now
DefiLlama’s insurance category holds $179 million across 32 protocols. Firelight makes up $67 million of that (38%), and the remaining $112 million is led by Nexus Mutual at $98.7 million. It’s important to be clear on what this figure actually measures - insurance-category TVL is the capital standing behind cover, not the amount of cover that has been sold. For the comparisons that follow, we use the figure that excludes Firelight, so that Firelight isn’t measured against the very gap it’s trying to close.
Put plainly, the gap is huge. For every $1,000 deposited in DeFi, only about $1.25 sits behind onchain cover. Measured against lending alone, that rises to $2.16, and even measured against curated vaults - the smallest of the three pools - it only gets to $11.72, just over 1%.
Against actual losses, it looks even worse. Protocols lost $1.35 billion to hacks in the last twelve months, which is about 12 times the $112 million standing behind cover outside of Firelight. Firelight, now the second-largest holder in DefiLlama’s insurance category, adds another $67 million, but even counting it, a single year of protocol losses is still 7.5 times the capital behind cover. In other words: outside of Firelight, the capital behind onchain cover adds up to less than a tenth of one year’s protocol losses. It’s not even close.
On top of that, the category is concentrated, with Nexus Mutual making up most of it once Firelight is set aside, and it has been shrinking. Indexed to September 2025, insurance TVL is down 23%, while curated vault TVL is up 26% over the same stretch. So capital is arriving at the vault layer far faster than protection is - though, as Section 4 shows, that’s starting to change.
Institutions need a loss story
When institutions pass on DeFi yield, it usually isn’t because they can’t find it - it’s because they can’t explain the downside risk to their risk committee. Any bank, exchange, or fintech putting customer funds into a vault needs a clear loss story: what happens if the underlying protocol gets exploited, who decides how much was lost, and how quickly the money comes back. Right now, the honest answer to the first question is usually that depositors take the hit.
Sun Raghupathi, co-founder and CEO of Veda, made this point when announcing Veda’s partnership with Firelight, saying that as more financial institutions and fintechs offer onchain products, “the appetite for additional protections, such as insurance from Firelight, are becoming a growing need.” Jesus Rodriguez, Firelight’s co-founder and Chief Product Officer, came at it from the product side. In the launch post, he wrote that a treasury may be fine with variable returns but unwilling to carry the full loss from a smart-contract exploit. What cover does is let an allocator keep the risks it actually wants and hand off the ones it would rather not hold. Of course, both of them have a commercial interest in saying this - but the numbers in Section 2.2 back them up.
Total Value Covered should sit beside TVL
TVL tells you how much has been deposited, but it says nothing about how much of that would survive a bad day. Sentora and Firelight first put forward Total Value Covered on March 18, 2026, and Rodriguez came back to it in the October 6 launch post:
We have spent years measuring total value locked. Total value covered deserves a place beside it, supported by details about limits, backing capital, and claims performance.
We agree, and we think the industry should start tracking a small set of numbers that can be compared from one product to the next. There are five we’d propose:
Total Value Covered (TVC) is the headline number - the sum of all active cover limits across vaults and markets, in USD.
Covered ratio is TVC divided by the TVL of the products it applies to. This tells you how much of a given vault’s deposits are actually protected, and stops a small covered vault from making an entire category look safe.
Backing ratio is the capital standing behind cover, divided by TVC. This shows whether cover is fully collateralized, or whether it has been oversold.
Premiums paid are the fees paid for cover, which show whether demand is real and paid for, or propped up by token emissions.
Claims history is the track record of claims filed, validated, and paid, along with how long each payout took.
With Firelight’s onchain data, all five can now be filled in. Cover orders, capacity, and incidents are all recorded onchain, and for the period October 6 to November 5, Firelight had $38.0 million of active cover against $55.9 million of capacity, backed by about $67 million of staked capital, a backing ratio of 1.77x.
In the second period, which started on November 5, all three orders renewed and Lido added cover on its EarnETH and EarnUSD vaults, taking TVC to $51.2 million. Against $280.8 million of NAV across the five covered vaults, that puts the covered ratio at 18.2% and the backing ratio at 1.17x. The new cover integration with Lido also diversifies Firelight’s cover profile considerably. Because each strategy now makes up a smaller share of total cover, stakers face less concentrated exposure, which lets Firelight deploy its capital more efficiently.
Metric | Firelight, period October 6 to November 5, 2026 | Firelight, period November 5 to December 5, 2026 |
|---|---|---|
Total Value Covered | $38.0M (68% of $55.9M capacity) | $51.2M |
Covered ratio | 77.5% ($38.0M of $49.0M NAV) | 18.2% ($51.2M of $280.8M NAV) |
Backing ratio | 1.77x | 1.17x |
Premiums paid | $56.9K this period (182 bps annualized) | $90.5K (215 bps annualized) |
Claims history | 0 incidents, 0 payouts | 0 incidents, 0 payouts |
Total Value Covered scorecard for Firelight, period October 6 to November 5, 2026. Sources: Firelight onchain data (Dune), October 19, 2026; DefiLlama.
And that’s really the key finding here. The headline metric for protected DeFi now has real numbers behind it, and as more vaults switch on cover, it can sit right next to TVL for every Earn program.
How Firelight Cover works
One shared pool of staked XRP
That brings us to Firelight, the protocol now providing cover on those same vaults. Firelight is a decentralized cover protocol built on Flare. Put simply, it’s a pool of staked capital that backs payouts whenever a covered vault suffers a validated loss. Flare describes it as a shared protection layer for DeFi vaults, which means every covered vault draws on the same pool - a single Firelight Vault on Flare, where stakers deposit FXRP.
There are six roles that make the protocol work. Stakers supply the backing capital by staking FXRP (XRP represented on Flare through its FAssets system), and get stXRP and protocol emissions in return - staking is permissionless, so anyone can do it. Program operators are the vault runners who choose to switch on cover for their vaults and pay fees to do so; in this first version, operators are permissioned institutions that have to pass AML, sanctions, and eligibility checks. End users deposit into an operator’s vault and never deal with Firelight directly. Curators, a role Sentora already plays, design the strategies that operators offer. The Risk Consortium independently validates incidents, and finally, Firelight Protocol stewards and holds its treasury. In claims, that entity also acts as Incident Reporter, opening incidents and preparing the loss schedules the Risk Consortium validates.
The documentation is also very clear that Firelight’s cover is not insurance. It doesn’t create an insurance contract with Firelight or with a vault depositor - instead, it’s a protocol-based mechanism that operators choose to switch on. That’s why this report sticks to “cover” and “protection” rather than “insurance.”
Phase 2 went live on October 6
Firelight’s Phase 2 went live on October 6, 2026, and for stakers, three things changed at once. Phase 1 positions converted over automatically, emissions started streaming in FXRP, and slashing exposure kicked in - because the same capital that earns emissions is the capital that backs the cover. Staked capital and any compounded rewards can now be slashed if a covered loss is validated, and exiting takes longer. Cover is written in 30-day periods, and an unstake only becomes withdrawable once one full period has passed after the period in which it was requested. Depending on when in the period a staker unstakes, the wait time is 30 to 60 days.
Firelight’s cover now runs on five vaults. The first two were Sentora’s: the Sentora USD Protected Vault offers diversified access to USD-denominated strategies on established DeFi protocols, while the Sentora Protected RWA Vaults run the real-world-asset strategies we covered in Section 1.4. According to Flare, the strategies themselves run as before, with Firelight adding verifiable onchain protection against a defined set of protocol failures on top. Kraken Protected Strategies USDC followed on October 15 (more on it in Section 5), and Lido’s EarnETH and EarnUSD vaults on November 5.
Beyond Sentora, Veda and Upshift are both integrating Firelight at the infrastructure layer, meaning any operator building on them can switch on protection for its own vaults, backed by the same shared pool. The deposit cap is 65M XRP as of Nov 5, 2026.
What happens when a covered vault is exploited
For any cover product, the claims process is where trust is won or lost, so it’s worth going through step by step. Every step is recorded onchain, in Firelight’s CoverOrderAllocator and IncidentManager contracts (the addresses are in the appendix), so the process can be checked by anyone. Firelight’s documentation breaks it into six stages.
Step 1 - Exploit confirmed. Once monitoring flags a potential exploit, Firelight, acting as Incident Reporter, opens an incident onchain. This freezes the set of exposed Cover Tokens and pauses any new vault deployments, so capital that comes in late can’t end up absorbing the loss.
Step 2 - Exploit report. ZeroShadow, Firelight’s designated security partner, then publishes an exploit report onchain, with a target of 48 hours. Assessment can’t start until that report has been recorded.
Step 3 - Assessment. The Incident Reporter prepares a proposed loss schedule within a 24-hour target, reconstructing each covered position's value before and after the exploit from onchain data. The five-member Risk Consortium then validates it within a 72-hour target. Approval needs a three-of-five quorum, and if an incident still isn't resolved by the end of the following coverage period, it expires with no payout.
Step 4 - Liquidation. The First-Loss Buffer, a protocol-owned reserve, takes the first tranche of the loss. The staked vault is only slashed, pro rata, if that buffer runs out, and the slashed assets are then converted to stablecoins.
Step 5 - Payout. The proceeds go to each Cover Token's beneficiary address, pro rata to the approved loss - for the Kraken vault, that beneficiary is the vault itself. If there isn't enough to go around, every beneficiary is reduced by the same proportion. Firelight is also introducing an option to route payouts straight to individual depositors through Merkl, a token distribution provider.
Step 6 - Closed. Once distribution is complete, the incident is finalized.
There are a few details here that matter more than the rest. For one, payouts are made in stablecoins to the beneficiary address the operator sets on its Cover Token - for Kraken, the vault itself. Depositors have no direct claim on Firelight, and what they receive is governed by the vault's own terms. Firelight says its planned Merkl option would snapshot the vault's shareholders at the block the incident began, allocate the payout pro rata up to the per-depositor cap and send stablecoins straight to depositor wallets, with the final distribution file published to IPFS so anyone can check it. The option isn’t described in Firelight’s documentation yet. Operators also don't need to file claims at all, since the registry automatically includes every exposed Cover Token. And so far, the IncidentManager contract shows zero incidents and zero payouts.
We also looked closely at who controls each step, because Sentora both incubated Firelight and curates every vault covered today. Firelight’s cover terms give the curator no role in claims. Firelight, acting as Incident Reporter, opens the incident and calculates the proposed loss schedule. ZeroShadow, an independent security partner, publishes the exploit report, and the five-member Risk Consortium approves or rejects the assessment. Once the Consortium approves, the terms say the payout runs automatically, and neither the Incident Reporter nor Firelight can block, delay, or override it. That still leaves a Sentora-incubated protocol preparing the numbers for Sentora-curated vaults, which makes the Consortium’s validation the independent check in the process and puts the weight on who sits on it.
Each of the five members brings something different to the table. Cyfrin audits smart contracts, Hypernative runs real-time threat detection, Credora produces DeFi risk ratings, GFX Labs works on governance and protocol design, and Native bridges traditional insurance broking with onchain risk transfer. Since no single member can approve a payout alone, the setup is meant to give institutions a neutral process they can point to. Whether it holds up, though, will only be proven once a real claim comes through - and that hasn’t happened yet.
What cover does and doesn’t touch
Firelight’s published list of covered events includes smart-contract exploits (logic errors, reentrancy, access-control failures, and upgrade flaws), oracle failures, governance exploits, bad debt and depegs caused by mechanism failure, and redemption failures. On top of that, each event has to fall within the terms of the affected vault. Firelight is careful to spell out the limits: cover only applies to specified events under published terms and limits, and cover on an RWA vault doesn’t guarantee every issuer or investment outcome.
If you set this list against the losses in Section 2.1, it lines up well with how protocols actually lose money. Drift’s proxy hijack, Tectonic’s donation attack, and Balancer’s rounding error were all contract, upgrade, or accounting failures, which is exactly the type of event this list was built for. What cover doesn’t touch are exchange hot-wallet thefts and wallet compromises, which accounted for $587 million of losses over the last twelve months. That boundary is important, because it sets the size of the problem that cover can realistically address.
Not every vault qualifies for cover
Cover is only available on markets that have passed Firelight's review process and been recorded in the onchain Cover Registry, and the operators switching it on are permissioned institutions that pass AML, sanctions, and eligibility checks.
The bar for a market is set out in the documentation. The underlying protocol needs at least one comprehensive audit from a recognized firm, sustained TVL, a track record on mainnet without a critical exploit, a publicly identified team, documented governance, and an active bug bounty. At launch, the approved list focuses on selected markets on established blue-chip lending protocols and DEXs, and the strategies built on top of them. The list starts small and is meant to expand as more markets clear risk review and approval by Firelight’s Risk Committee.
The reason comes down to how a shared pool works. Every covered market draws on the same staked FXRP, so a single poorly understood market would put every staker, and every other covered vault, at risk. If any vault could plug in, the pool would end up pricing the worst of them.
Connor Sullivan, Chief Strategy Officer of Firelight, put it this way: "Firelight was never meant to sit under every yield vault in DeFi. It's designed as a protection layer on top of institutional-grade earn infrastructure - vaults with clear strategies, known counterparties and risk that can be quantified. A vault chasing yield by taking on risks nobody can properly explain isn't something that should have onchain cover, and we'd rather say no to those than weaken the cover for everyone else."
For depositors, Firelight cover on a vault means the markets it allocates to cleared Firelight's risk review before protection was switched on. It isn't an endorsement of the vault's strategy or a guarantee of its returns.
Team, funding, and audits
Firelight is incubated by Sentora and built by Sentinel Labs. Sentora co-founders Anthony DeMartino and Jesus Rodriguez serve as CEO and CPO of Firelight. Connor Sullivan serves as Firelight’s chief strategy officer. The protocol draws on Sentora’s risk infrastructure, which Flare describes as more than 1,000 proprietary risk models covering more than $2 billion of deployed assets and more than 300 monitored strategies (self-reported).
On September 1, 2026, Firelight announced an $8 million seed round led by Gumi Cryptos Capital, with Maven 11, Metalayer, and Tribe Capital also participating. Firelight’s Phase 1 contracts were audited by OpenZeppelin, with a frontend audit by Coinspect and an Immunefi audit competition. The Phase 2 coverage contracts were audited by 0xMacro and went through a second Immunefi competition. ZeroShadow serves as Firelight’s security partner. Firelight uses Flare’s FAssets as a primary method to bring XRP onchain as FXRP, which runs on overcollateralized, decentralized, and independently audited bridge infrastructure.
Firelight’s audits are publicly available and can be found in the Audit and Security section of their official documentation.
Collateral beyond XRP
XRP is the first collateral asset, with BTC and XLM as likely upcoming assets. Co-founder Anthony DeMartino told CoinDesk that any solid, liquid asset that doesn’t generate its own natural yield should eventually be eligible.
The thinking here is that cover capital shouldn’t move in step with the DeFi vault it is backing. A pool backed by DeFi-correlated tokens would lose value in the very same crisis that triggers claims - and Rodriguez points to this as one of the reasons earlier DeFi insurance struggled to scale, with backing capital falling in value just as covered losses were rising.
Firelight’s first numbers
Staked capital has doubled
As of October 19, Firelight has $67.1 million in staked capital, up from $54.1 million on December 9, six days after Phase 1 launched. Since this is a staked-XRP product, the dollar figure moves with XRP’s price - so to get a better sense of what depositors are actually doing, we divide TVL by the daily XRP price to get a derived XRP-equivalent figure. Using that measure, deposits have roughly doubled, from about 25.7 million XRP in December to about 51.1 million XRP today.
That growth didn’t come in a straight line - it came in waves. In December, the first cap of 25 million XRP sold out within hours, according to the team, and deposits hovered around that level through the winter. Then on March 19, XRP-equivalent TVL jumped by about 21.8 million XRP in a single day, which lines up with the team’s account of raising the cap to 65 million XRP and filling more than half of it on day one, in a wave it describes as retail-driven. Deposits peaked at about 64.3 million XRP on June 5, just under that cap (USD TVL had peaked earlier, at $90.8 million on May 15, when XRP was more expensive). Since then, deposits have drifted lower and now sit 20.5% below the June peak.
$38 million of cover in the first period
Firelight went from zero to $38.0 million of active cover in its first 30-day period. That’s the Total Value Covered for October 6 to November 5, made up of three cover orders - $5.0 million, $2.5 million, and $30.5 million - all placed on October 5, the day before launch. The period’s capacity is $55.9 million, so 68% of it is already in use, and with about $67 million of staked capital behind it, every dollar of cover has $1.77 of capital backing it. In front of the stakers sits a $1.0 million First-Loss Buffer, held in USDT0.
Cover also now has a price. Premiums for the period total $56.9 thousand, which works out to a blended annualized rate of 182 basis points, and the three orders were priced at 300, 230, and 159 bps, with the largest order carrying the lowest rate. This is the real shift - insurance-category TVL measured capital sitting and waiting for claims, while active cover and premiums measure demand.
One structural risk is worth naming once. Cover is denominated in USD, while the capital backing it is staked FXRP, so the value of that backing moves with XRP. That’s why the backing ratio matters, and why the First-Loss Buffer is held in USDT0.
Incentives still drive staking
Firelight ran a points program for early depositors, and its first round of protocol emissions goes to early contributors in proportion to their points, claimable as FXRP through Merkl. Over time, emissions are meant to track protocol revenue, which comes from the fees operators pay for cover. For now, though, incentives are a big part of why people stake, and Firelight has hinted at potential future emissions for early stakers and point holders, so TVL shouldn’t yet be read as purely organic demand for cover.
Plenty of room to grow
On September 23, Firelight announced a partnership with Veda, which says it has powered more than $32 billion in deposits for more than 300,000 depositors across nearly 300 integrations, and counts Kraken and EtherFi among its clients. On October 21, Firelight also announced an integration with Upshift, an infrastructure provider that allows fintechs, asset managers, exchanges, and other platforms to launch and operate vaults across more than 30 chains. The Veda integration is already live on Kraken’s vault, and Firelight is openly inviting fintechs to reach out and build vaults with protection included.
Cover is still tiny relative to the vaults it could protect, and that’s the runway. $38.0 million of active cover works out to $3.98 for every $1,000 of risk-curator TVL and $20.64 for every $1,000 of Veda’s TVL. These are scale comparisons rather than covered ratios, since not all of that TVL is eligible for cover (see Section 3.5), but they show how much room there is.
So where does that leave Firelight today? It has real staked capital, $38.0 million of paid cover, live cover on a major exchange’s Earn vault, and a pipeline into the infrastructure that sits behind many Earn products. What it doesn’t have yet is a customer outside Sentora - as far as the evidence shows, all of today’s cover sits on vaults Sentora curates.
Cover goes live on Kraken
Sentora’s dual role as curator and cover incubator
Embedded yield now has a fairly clear shape. Curators set the strategies and limits, and distributors own the customer. Cover was the missing layer, and it’s now live on Sentora’s own protected vaults and on Kraken.
What makes Sentora unusual is that it sits in more than one of these layers at once: it’s one of the two largest curators, it designs the strategies behind Kraken’s Earn vaults, and it incubated the protection layer. Sentora flagged this from the very start. In its January 26 Kraken launch post, it listed embedded cover from Firelight on its roadmap and said it was actively exploring how to integrate it. Less than nine months later, that cover is live on Kraken’s Protected Strategies USDC vault.
Cover on Kraken’s Earn vault
The same Kraken vault from Section 1 now has cover enabled. On October 15, Firelight announced cover on Kraken Protected Strategies USDC, the vault on Kraken DeFi Earn that was formerly called Boosted USDC. It runs on Veda’s infrastructure, it’s curated by Sentora, and Firelight calls it its first integration with a major crypto platform. The cover applies to the vault itself, with validated payouts released directly to it, and its scope, capacity, and pricing are registered onchain and reset every 30 days. Press coverage of the launch reports the cover at $30.5 million.
Kraken says more than $800 million has been deposited into its DeFi Earn vaults since January, and Marcel Ohngemach, Kraken’s Product Lead for DeFi, called the integration “a step toward giving DeFi users clearer options around onchain risk.” Kraken’s guidance is also careful about the limits. According to press coverage, the cover is not insurance, it isn’t guaranteed by Kraken, and it’s capped at $100,000 per depositor address per coverage period.
Because cover is enabled through Veda’s infrastructure, the release says other exchanges, fintechs, and vault operators building on Veda can switch on protection for their own products in the same way.
What changes for depositors, platforms, and curators
For depositors, a vault’s headline yield now comes with clearly defined cover terms - which failures are covered, who validates a claim, and how payouts flow. Under Firelight’s design, depositors only get protection through the operator’s terms and have no direct claim on Firelight, so those terms are what they’d need to read.
For distributors like exchanges and wallets, cover gives them a much stronger answer to the question every risk committee eventually asks: what happens if an underlying protocol gets hacked? That’s a real edge over Earn products that route into DeFi with no protection layer at all.
For curators, it opens up a way to sell protection as its own product tier, with the curator keeping its curation fee and Firelight earning the cover fee. An allocator can then see the return after the cost of cover, the losses that stay with them, and the conditions under which protection applies.
And for the market as a whole, it creates the chance to publish Total Value Covered right next to TVL for every program. Cover is now priced, and what’s left is scaling it beyond Sentora-curated vaults and testing it with a real claim.
What to watch
Third-party cover customers. Cover is live, including on Kraken, but so far all of it sits on Sentora-curated vaults. The next big signal will be an operator outside Sentora’s vaults switching on cover, whether that comes through Veda, Upshift, or directly.
A covered ratio and the next cover period. TVC is now measurable at $38.0 million, but the TVL of the covered vaults is still needed to turn it into a covered ratio. The first period also ends on November 5, and whether the orders renew will be the first real read on repeat demand.
Staked capital as the unstaking window lengthens. XRP-equivalent TVL has held flat since launch, but it’s still 20.5% below its June peak. As the unstaking window moves from days to 30 to 60 days, we’ll find out just how sticky this capital really is.
Capacity against the cap. If the “$115 million XRP” cap means 115 million XRP, the pool is at about 44% of capacity today; if it means $115 million, it’s at about 58%. Either way, there’s still room to grow before the cap becomes the constraint.
Phase 2 audit disclosure. The 0xMacro audit of the Phase 2 coverage contracts is now linked from Firelight’s Audits and Security page, alongside the Phase 1 reports. The Phase 2 Immunefi competition is listed there without a published report, so its results are what’s left to publish for the feature-complete release.
Collateral expansion. BTC through Lombard and XLM have both been named, and broader collateral would reduce Firelight’s reliance on a single asset and a single community.
The first validated claim. This will be the real test of the First-Loss Buffer, the Consortium’s speed and independence, and the slashing mechanism - until a claim happens, none of it has been proven in practice. Stakers should also keep in mind that compounding without withdrawing means taking on a growing slashing exposure over time.
Other cover protocols and exchange moves. Nexus Mutual still holds most of the legacy category. A competing vault-level product, or another exchange switching on cover for its Earn vaults, would change the picture quite a bit.
Where cover stands today
Vault-based Earn programs are the fastest-growing corner of DeFi yield right now. Curated vault TVL is up 26% since September 2025 while lending is down 39%, and exchanges like Kraken and Coinbase are now selling these products to retail customers - Kraken’s program alone has more than 80,000 depositors. At the same time, hacks have taken between $1.6 billion and $4.0 billion every single year since 2020, and DeFi protocols alone lost $1.35 billion over the last twelve months. Set against all of that, the capital standing behind onchain cover, outside of Firelight, works out to about $1.25 for every $1,000 in DeFi.
This mismatch is why serious allocators still hold back, and why the platforms selling yield are carrying exposure they can’t easily explain. Protection has been the missing piece, and the number that tracks it, Total Value Covered, has grown to $51.2 million since Firelight’s launch.
TVL tells us how much DeFi attracted. TVC will tell us how much of it is safe to sell.
Firelight is the first serious attempt to fill that missing layer at the vault level. It went live on October 6 with about $67 million of staked XRP behind it, an $8 million seed round, a five-member Risk Consortium, and coverage on two Sentora vaults and on Kraken’s Protected Strategies USDC vault, with integrations through Veda and Upshift, two of the infrastructure providers behind embedded Earn.
What it doesn’t have yet is a customer outside Sentora’s vaults, a covered ratio, or a tested claim. Those are the milestones that will decide whether protection becomes a standard part of onchain finance, or stays a good idea attached to one curator’s vaults. And as curator, incubator, and first operator, Sentora is the one positioned to benefit if it does.
Appendix - Firelight Contract Addresses On Flare
As listed on Firelight’s onchain analytics dashboard (Dune). Links go to the Flare explorer.
Contract | Address |
|---|---|
FirelightVault (stXRP) | |
CoverNFT (Cover Token, ERC-721) | |
CoverOrderAllocator | |
IncidentManager | |
XRP/USD price feed | |
First-Loss Buffer wallet (USDT0) |
Sources
DefiLlama: TVL data (total DeFi; the risk curators, lending, yield aggregators, and insurance categories; Veda, Upshift, and Firelight), curator TVL and fees, XRP price, and the hacks database. Pulled October 19, 2026.
Firelight onchain analytics (Dune), “Coverage Analytics”: period book, cover orders, First-Loss Buffer, and incidents. Queried October 19, 2026. Powered by Dune Analytics.
Firelight documentation (docs.firelight.finance), including the Cover Scope, Claims Process, Claims Liquidation, Supported Protocols and Markets, Unstaking and Withdrawals, and Audits and Security pages (checked November 4, 2026).
Firelight press release on cover for Kraken Protected Strategies USDC (October 15, 2026, GlobeNewswire).
Jesus Rodriguez, “Firelight Is Live: Building the Protection Layer DeFi Needs to Grow,” Medium (October 6, 2026); Firelight Medium post and DefiLlama Research spotlight on Total Value Covered (March 18, 2026).
Flare, “Firelight Is Live, Backed by Staked FXRP on Flare” (October 6, 2026).
Firelight and Veda partnership announcement (September 23, 2026).
Sentora: Kraken DeFi Earn case study (as of July 2026); posts on Kraken DeFi Earn (January 26, 2026), Kraken deposits (May 27, 2026) and xStocks Earn (September 14, 2026).
The Block: Kraken DeFi Earn launch; Bitwise as a Morpho vault curator and comments from Morpho CEO Paul Frambot (January 26, 2026).
CoinDesk: Firelight’s $8 million seed round and interview with Anthony DeMartino; Kraken Bitcoin Vault (May 2026).
Crypto Briefing and The Defiant: coverage of the Kraken launch, including the $30.5 million cover figure and Kraken’s $100,000 per-address cap (October 2026).