After the $16.5 billion in exploits, DeFi is now being forced toward the controls it once resisted

Make CryptoSlate preferred on

The rsETH crisis resulted in $200 million in bad debt on Aave’s books, despite not a single line of its contracts misbehaving.

On Apr. 18, attackers that Chainalysis preliminarily linked to Lazarus compromised RPC infrastructure, forced a failover to poisoned nodes via DDoS, and injected false data into a 1-of-1 DVN configuration on KelpDAO’s rsETH bridge.

The forged message released approximately 116,500 rsETH, and Aave’s incident report confirmed that Ethereum accepted nonce 308 while the Unichain source endpoint never advanced past 307.

The attacker supplied the compromised rsETH to Aave and borrowed against it, resulting in bad debt and serving as a frame for the current state of DeFi’s security.

Exploiters extracted over $635 million across 28 incidents in April, the worst monthly total in over a year. DefiLlama puts the cumulative historical cost of hacks at $16.5 billion, with $7.7 billion specifically targeting DeFi.

The high-profile exploits on Drift and the KelpDAO bridge resulted in DeFi losing nearly $11 bilion in total value locked last month.

That contraction occurred as stablecoin rails, tokenized treasuries, and regulated settlement layers gained institutional traction in the same capital markets.

How did DeFi end up here?

Mitchell Amador, CEO of Immunefi, told CryptoSlate that DeFi has historically rewarded growth, integrations, liquidity, and speed over security maturity.

A protocol that adds a new asset, bridge, oracle, adapter, or external dependency gains immediate utility. The risk that integration carries produces no visible price signal until an exploit materializes, because the absence of an incident is invisible while it holds.

That asymmetry kept audit cycles and isolation practices secondary to shipping velocity for years, until April concentrated the consequences into a single month.

Amador said the most overlooked practices were multisig hygiene and management, supply chain hardening, real-time monitoring, and emergency response procedures.

Too many teams treated multisig as a security solution in itself, when its actual strength depends on signer count, the independence of those signers, their operational setup, and the processes around transaction review.

A low-threshold multisig, weak signer security, or a poorly monitored bridge or oracle can become a systemic exposure because DeFi protocols are composable by default. In this landscape, risk travels through integrations as efficiently as liquidity does.

While that culture was forming inside DeFi, a different model was being built in parallel.

Solstice Finance CEO Ben Nadareski assessed:

“The gap in output per person tells you what happens when you strip away everything that isn’t the core financial function. The teams that win this round will be the ones built on compliance and security from day one, ready to ship faster than a bank can call a meeting about it.”

DeFi built composable rails for over half a decade before Wall Street recognized them as the actual infrastructure layer of the next financial system.

The cost of that early market position was a security culture calibrated for speed over operational discipline.

Kasper Pawlowski, CTO of Euler Finance, names the governance dimension of the same failure in his post-incident analysis.

He said:

“DeFi treats risk assessment as a one-time onboarding decision, when in reality risk is dynamic.”

The 1-of-1 DVN configuration that enabled the KelpDAO exploit existed in production for years. Kelp says it was the default LayerZero shipped and reviewed across multiple integration meetings, while LayerZero says Kelp downgraded to it.

Whichever account is accurate, the configuration persisted unflagged through every integration with every downstream protocol. LayerZero has since banned the configuration on a protocol-wide basis, acknowledging that allowing its DVN to act as the sole verifier for high-value transactions was a mistake.

The more consequential point is that a critical bridge-security parameter was normalized across the entire dependency chain until a $292 million exploit surfaced it.

Pawlowski argued:

“The operational machinery DeFi has built — DAO governance, external risk service providers, and monthly review cycles — doesn’t move at the speed the underlying risk surface does. In many cases, the people doing the reviewing aren’t structurally independent of the assets they’re reviewing.”

That structural conflict produced the specific governance failure Pawlowski dissected. Aave’s 25,000 ETH treasury recovery proposal was authored by TokenLogic, a paid Aave service provider that publicly lists Kelp as a client and operates an Aave delegate platform.

For reference, TokenLogic is the same firm voting on its own proposals. On the same day Aave expanded rsETH to a 93% loan-to-value ratio in eMode, SparkLend deprecated the asset entirely, bundling the move with routine cleanup of underused positions.

Three months later, that routine pruning was the only separation between Spark’s depositors and the bad debt Aave now carries.

One protocol’s independent risk judgment outperformed another’s full-stack risk advisory apparatus. DeFi’s review machinery generated worse outcomes than a single asset manager doing portfolio hygiene.

What “here” means

Before the exploit, Aave was the largest DeFi protocol by total value locked, with over $26 billion in deposits.

Pawlowski noted:

“Aave was the gold standard. If Aave can carry $200 million-plus in bad debt from a bridge exploit on a different protocol, the market has to recalibrate what ‘safe’ actually means in DeFi lending.”

The pooled lending model is only as strong as its weakest accepted collateral, and when that collateral breaks, the entire shared pool absorbs the damage. The exposure reaches every depositor in the broader market, extending well past the vault that held the position.

Pawlowski pointed out that the structural reality had been “muted by years of ‘battle-tested’ and ‘blue-chip’ marketing.”

Amador broadened the exposure map beyond the mechanics of KelpDAO. The attack surface in DeFi now covers governance, signers, privileged roles, integrations, bridges, oracles, custody arrangements, and every external system a protocol depends on.

The most dangerous operational assumption a team can hold is that audited smart contracts equal a safe protocol. Immunefi’s own research shows that DeFi losses declined by as much as 80% over the last several years, because the sector hardened its code and attackers adapted.

Amador added that they now study the entire risk chain for the weakest points, and those points are now off-chain, governance-adjacent, or buried in dependency stacks that no single audit covers.

For institutions, April forced a specific reset. Amador described the checklist now: how admin keys are managed, who can pause markets, what dependencies exist, what the incident response process looks like, and how quickly a threat can be contained.

Pawlowski made the same point from the capital side, saying institutions will continue to enter on-chain credit because the demand for tokenized markets, transparent settlement, and programmable financial infrastructure is real.

However, the institutional investors will move toward isolated markets, permissioned or curated vaults, stricter asset onboarding, better insurance, continuous monitoring, and formalized emergency controls.

Aave Horizon, a permissioned market for tokenized securities and RWAs launched in August 2025, has grown to more than $440 million in deposits.

Morpho’s vault ecosystem added ARCHITECT, the first FINMA-licensed investment manager to curate vaults at scale, and Flowdesk launched an institutional AUSD vault in March 2026, using tokenized equities as collateral.

EY-Parthenon and Coinbase’s 2026 survey found 73% of institutional respondents plan to increase digital asset allocations this year, but 81% prefer registered vehicles. Capital is moving on-chain through curated, governed, and compliance-aware structures.

The regulated alternative is accelerating on the other side of that same preference.

The GENIUS Act created the first federal framework for US stablecoins, with mandatory 100% reserve backing, no rehypothecation, and custody standards that Nadareski said “read like something a compliance desk could approve.”

A Goldman Sachs survey found 35% of institutional investors named regulatory uncertainty their biggest blocker, and 71% said they would increase exposure once clarity arrived.