DeFi users pull $10 billion out of the market as $292 million exploit sparks bank-run optics