DeFi Reality Check & the KelpDAO Hack

Transcript

Ah, Ave had its record weekly outflows. And this has nothing in particular to do with the hack. This is almost like a run on the bank. >> So, April was brutal, but the ecosystem and DeFi absorbed two quarter billion dollar hits and didn't die. >> Are we under pricing risk in DeFi right now? Lending rates were below the risk-free rate, which is absurd. [music] DeFi's not dead. DeFi will remain, but maybe some things will change. I think [music] this was a transformational moment for the whole industry.

>> A lot of these hacks that we have seen recently, they are related to single points of failure. What AI allows today is for these type of attacks to become much easier to engineer. If Mythos is really what they say it is, every bank, every single financial infrastructure is at risk. It's not just DeFi. >> I do think that DeFi's probably the biggest target because As always, note that none of the

information discussed constitutes investment advice or any offer, recommendation, or solicitation by Blockworks Galaxy Bitwise or Anchorage, or any of its affiliates to buy or sell any securities. Everyone, welcome back to Inflection Point, the podcast for institutional digital asset news. I'm joined as always by Matt Hougan of Bitwise, Michael Marc Antonio from Galaxy, and David Lawant from Anchorage. Um, this episode, I think we're being we're going to basically forced to talk about the recent KelpDAO hack. I mean, it's having, you know, huge impacts on the entire market, DeFi lending, and also Um, let's let's kick it off. Maybe Michael, you want to do an overview of of what happened?

Sure. Um, we want to talk about uh Kelp and and in particular, what what do we want to start with? Um, yeah, Kelp on the LayerZero on the the the recent um DVN hack. Right. So, I mean, April 2026 is now the worst month for crypto exploits since the Bybit hack in February 2025. Roughly 606 million has been stolen across 12 incidents, I believe in about 18 days. So, um it's pretty bad. Uh, the two mega exploits, of course, uh account for 95% of that, so it's good to keep it in perspective, but um we've got the Drift hack, which we touched on lightly um last week, just a high-level overview.

You know, that wasn't a code bug exploit. That was, you know, a almost a six-month con job. Uh, North Korea, their hackers, like in the Lazarus Group, um are largely suspected of doing that. Um, and they posed as a quantitative trading firm, spent months building relationships with the members of Drift's Security Council. Um, and, you know, the group of humans who held the admin keys, they became quite quite close with. So, there were fake recruiters, contacts, you know, bogus, you know, VC intros, uh what else? Like doctored Calendly links, you know, classic social engineering. Um, and that was able to

get Drift's keys. Um, but you know, the KelpDAO happened on April 18th. Um, I believe the damage to KelpDAO has been or the the headline number is 293 million has been lost, but the number is much bigger than that. I'll explain that in a second. So, um Kelp, unlike Drift, was an infrastructure exploit. Um, and it was not a social engineering exploit. Um, I want to be clear when I say infrastructure exploit, what I don't mean is like the the code had a bug in it. It was the deployment of the code that was the problem. So, KelpDAO is like a liquid restaking protocol. Users

deposit staked ETH and get rETH in return, which they can then use across multiple DeFi protocols. Um, and to make rETH work on like 20 plus chains, I believe rETH was on like Arbitrum, Base, Mantle, UniChain. Kelp uses something called LayerZero. Um, and for our users that don't know what LayerZero is, LayerZero is an omnichain um like bridge, okay? It is a bridge between chains. And just a very simple explanation of what LayerZero does is pass messages between chains and lock funds on one chain and

then create a a clone of those funds and a like a sort of a a a a a wrapper of those funds on a different chain. So, when rETH leaves Ethereum to say go to, I don't know, Arbitrum, rETH gets locked in an escrow account on mainnet, and then matching tokens are minted on the destination chain like Arbitrum. So, the entire hack came down to like a configuration choice. Kelp's bridge was set up to accept cross-chain messages verified by a single validator.

Um, a one-of-one decentralized verifier network validator that was operated by LayerZero. Doesn't really matter what that is, but the point is there was no redundancy here. So, like one of the big value props of DeFi is redundancy, decentralization. Here, there was no such redundancy. Um, there was no multi-sig verification. So, one forged signature in this scheme was enough to make any cross-chain message like look legitimate, but was not. And so, on April 18th, the attacker sent a single forged um you know, receive call to LayerZero's endpoint uh claiming rETH had been locked on another chain. The bridge

believed that it had it had it was released. Uh I'm sorry, the bridge believed that that was correct and then it released I think something like over 115,000 units of rETH. You know, so roughly 18% of the entire circulating supply, which was worth 293 million, um to the attacker's address. And it was just in one transaction. Now, um that is not where the damage stopped. Because rETH is like sort of a wrapper of ETH. Um, and so there's not that much liquidity to dump 115,000 116,000 units of rETH into DEX liquidity. It would have crashed the price instantly. It would have been a

disaster. Um, well, and it would have been inefficacious for the attacker because, you know, they would have not been able to pull out $293 million worth of ETH, right? Um, but they were smart and instead they used the stolen tokens um as collateral on Ave. And here's where like composability, I think, starts to backfire a little bit. Um, or composability can actually breed contagion. So, um what the attacker did, I believe, um is they deposited that rETH into various Ave pools. So, they they used it as collateral to borrow, I think,

something like 50 over 50,000 wETH, which is wrapped Ethereum. Um, and on actually, no, it was definitely more than that. Um, it was probably something like 80, 90,000 wETH. Um, and smaller uh and they did this on Ave mainly, but also took smaller positions on Compound and and Euler. So, um the total extracted amount was about 200 to 236 million in borrowed liquidity. And with that ETH now, what can they do with it? Well, they do what they always do. They route it through Tornado Cash. Um, ZachXBT flagged it in minutes, and uh the rest is history. So, that's sort of the high-level on on what happened.

I love that. That was a very clear and holistic explanation. Thanks. Thanks, Michael. So, so yeah, I mean, what what's left me confused is it's one of these hacks where everybody's playing the blame game. Um, LayerZero says that it was Kelp's misconfiguration of their bridge that led to it, whereas Kelp um Kelp is saying that the default implementation of the bridge is what LayerZero uh recommended, but but regardless, it was it seems like it was actually the lending protocols, and in particular uh Ave, who was hurt from from whoever's fault this was.

Yeah, that's right. I mean, I think something like over 5 billion of TVL was pulled off of six like six to eight billion TVL drop on Ave. Um, they were left with 177 hundred to between 177 and 190 million dollars of bad debt in rETH. Um, so yeah, uh Ave Ave got hit hard there. Yeah, this is a very big moment for DeFi, very important one. DeFi's not dead. DeFi will will remain, but maybe some things will change. I think this was a transformational moment for the whole industry. And there's many aspects here that we can look into this hack. There is the blaming game that is

happening a little bit on the cause. There's the Ave aspect to it. There's also the Arbitrum side that Frozen has frozen some funds. So, there's a lot of very fundamental discussions. Uh Mark, I think you were starting to get into the one between LayerZero and Kelp. And here there's a lot of finger-pointing. Uh maybe we don't need to get into all these specifics, but the thing is that Kelp was saying, "Hey, uh this way that the the the interopera- interoperate was set up is basically what you guys suggest. And LayerZero is kind of saying the otherwise, uh the the

other way. So, they're kind of pointing fingers a little bit off each other. The most important thing to highlight here, in my view, is number one, all these hacks, and to Michael's point, a lot of these hacks that we have seen recently, they are related to single points of failure. This speaks a little bit to the theme that uh we have sometimes less decentralization than we think we do uh in DeFi. And that's not necessarily a bad thing, but I do believe that we're going to have to draw this line a little bit more clear- clearly going forward. We talked about this in others, uh in other contexts, quite a few times in the in this

podcast. So, that's the first thing. And then there's a second thing, which is also an interesting aspect of on the Kelp side, which is who is going to take the blame, right? Because there is this discussion on whether the because as Michael said, you got a release on the Kelp L1 from a fake message coming from an L2, right? That's exactly what happened. The question now is, who takes the hit? Is the hit socialized between L2 and L1 users? Or is the hit ex- uh concentrated just on the L2 users?

These two scenarios, I think are possible. Last time I saw there was a Polymarket, I think betting mostly that the losses would be pushed uh into the L2 users. I was surprised to see that. I would be curious to see uh what what you guys think as well. Other protocols might be exerting pressure as well, because for example, Aave will benefit more one way or another. So, there is a big discussion here that hopefully will be solved in the next few days. But I but I I understand that this is a very complex decision to make on who is going to take the uh the hit in terms of Kelp users, right? Is it going to accrue only to the L2, or is it

going to be socialized more broadly? Yeah, I think those are are big are big topics. Just to add the other big topic, I think the elephant in the room is is Mythos. I think absent the Mythos fearmongering, this would just be a normal DeFi hack. I know it's a big one, and it raises some big existential issues, but I don't think people would be talking about the end of DeFi, or maybe freaking out quite as much as we've seen people freaking out, if there weren't this broader security environment concern overhanging the market. Uh it's obviously not related to the Kelp DAO attack, but I think people are conflating it in their mind, and then wondering, do I really want my assets exposed to DeFi given the concerns raised in this hack, the

concerns raised by Mythos? I think it's one big stew of worry that is part of why you're seeing people step back from the space pretty aggressively. Yeah, I mean I was going to bring this up, actually. Um not in the context of Mythos, which is quite scary in a lot of ways, but just in the context of what we know and what is public right now with respect to AI. So, what AI allows today is for these type of attacks um to become much easier for exploiters to dis- uh determine and to um and to engineer. Um and it's it's you know, this attack may

have taken a year ago or two years ago months for an expert to read a smart contract and to figure out. But with just just with Opus today, you know, or or you know, GPT you know, five, like this becomes a lot easier to do. Um but at the same time, just to be very clear, it also allows for protocols and security firms uh a superpower to be able to harden their own infra. Um and to to patch potential flaws.

So um what you're seeing with Mythos right now is, I believe, Anthropic provided Mythos to a few of the top uh software companies in the world to use on their own infrastructure to identify if there's any zero-day exploits. Um and I suspect that um when Mythos if Mythos is ever released to the public, um the first thing that every protocol will do is make sure that uh their um their their their you know, they use Mythos to audit their own programs. Um but of course, a zero-day exploit is pretty scary because it can happen obviously zero day. So, it's if there's there

you know, Anthropic's got to be very careful with how they roll out more advanced uh AI um models, but um I think AI is going to in- both increase the uh frequency of these exploits over the next 6 to 12 months until the industry uses AI, and they are to some extent already, but to really make sure that they're uh that they're patching any any bugs that uh that AI could make much easier to identify for uh for hackers. Yeah, it's definitely going to be a big moment. Uh the one thing I want to highlight is that I think there was a Bloomberg report saying that has been unauthorized access to Mythos uh the past year or so. It doesn't look

like it's anything related to cybersecurity, but yeah, uh it's yeah, things are getting very interesting now. Yeah, I mean, like I guess the only thing I would I would argue about here in defense of DeFi is like, if Mythos is really what they say it is, like every bank, every single financial infrastructure is at risk. It's not just DeFi. I agree. I agree. But it's it's I think it's heightened the concern and it's part of why you've seen quite this level of uh of freakout. But let's let's get into it, Mark. What what what specific areas do you want to dig into?

Yeah, and I I I just wanted to add, I do think that DeFi is probably the biggest target because, you know, we talked David and I talked about this in the quantum episode, but when you have when you have bare assets, unlike you do in a traditional financial system, and you have probably weaker risk management systems, it just makes it a much easier target. So, if I was a black hacker, and I black hat hacker, sorry, and I thought that and I got access to these most powerful models, honestly, my first my first go-to would be would be DeFi. That would be my first target. So, I I think while everybody should be concerned about it, I I do particularly fear for for DeFi in particular. Um

but I I I I also wanted to just talk about not just the technical aspects of the hack and and who blamed. Um it's already having repercussions in the market itself. So, I'll put it up on screen here. We we saw that Aave had its record weekly outflows. This is depositors being afraid that maybe their funds are also at risk um because, you know, I don't I don't even think it matters if you understand the configuration of how this exploit occurred. I think it's just the fear of it happening. And then we had one of the next biggest weekly outflows already, um and it's this is like a half a week.

This is this data is only up until yesterday. And it And I want to ask you all this, but kind of puts into my mind what what what do we think about pooled lending? Like I don't know if anybody remembers, but it Aave, or maybe it was Sky previously, MakerDAO, it started off as a peer to peer model, and it didn't scale. It was very expensive. Risk management was a nightmare. And then this is why we have this peer to pool to peer model, cuz it it pools the liquidity, it makes it a lot easier um um for for both lenders and borrowers.

But now we're starting to see kind of the tail risk effects of that, and that is you're also sharing the pool risks as well. And you know, and luckily there are you know, advancements on the way for more modularized lending, where the pools are segregated depending on the asset type, depending on the borrowers and lenders, and that those configurations is it's like a hub and spoke model. Even even Aave is going to have this hub and spoke model in their V4, which they recently released. Um but interestingly, uh the users didn't flee to more modularized lending platforms. Most of

it actually went to Spark, um which is also a pool lending platform. So, I'll just pause it right there and like get your guys' takes on it. Like, are we underpricing risk in DeFi right now? Uh I think we have been. I mean, I think that's pretty obvious. I don't No one's going to I don't think anyone's going to argue with that. We Lending rates were below the risk free rate which is absurd. Uh and they were below the risk free rate because people were doing these complex restaking and looping strategies to try to juice up yields to get a risk free yield of 9 to 18%. There is no risk free yield of 9 to 18%. It was only because people were able to do these complex

multi-step processes on relatively low yields. So I would say that yes, we have been mispricing risk in the market. I think that's a fair statement and I I I suspect that that will uh go away and uh be cured by um by more risk being priced into these things over time. Um I think that's a fair assessment. Um I would also say perhaps this is coming kind of from two things. The first and we kind of talked about this in the vaults episode we did, which is the DeFi lending and borrow market is still relatively new and and and it's evolving and the

use cases are still very concentrated. So the flows are very one-sided. It's not like these more mature markets where you have both sides being very active. So So there is a little bit of a one-side only feature here and that will translate sometimes into very low borrowing rates, sometimes into actually pretty high borrowing rates, right? So like a year or maybe a year and a half ago, you could just park your stablecoin on one of these borrow and lend protocols and get 10 to 12%. Uh so so I think this is a feature of these uh still limited use cases that we see on chain and then demand and supply kind of go like really um really in this in this way.

The second thing, Mark, is about the structure and the way that these protocols are built and and I think that's the point you were touching on and by the way, we need to give a heads-up to the Blockworks research team because there's an incredible note. Uh it's called what is called cracking the monolithic thesis uh and it talks about this in detail. But I think the important point that Mark is highlighting here is that you have some protocols like Aave that up until now, this is going to change in the new version, uh Aave V4, things are going to change a little bit. But Aave has made extensive use of this pooled liquidity feature. And this is great in a sense that it attracts it's obviously

I mean, everybody wants liquidity. This makes for a great UX. Uh maybe this is one of the reasons why Aave has grown so much over the years and it's probably the or one of the most successful DeFi protocols. But also, especially when you're talking about these newer assets that are less understood, the issue is that you start to kind of commingle different different collateral types within the same pool and that makes it a lot harder to price risk. You have other models, right? Like the Morpho models or the model that Aave will be migrating to where you can actually have the possibility of pricing

your risk depending on the collateral type, for example, that is underlying that credit. So I think I mean, things are were already pointing in the right direction. I think this exploit just make it clear the risk that is embedded in some of these monolithic um credit pools. It's not that monolithic It's not that aggregated liquidity is bad. Actually, aggregated liquidity has its obvious advantages and I think the note highlights that beautifully. Of course, if you're talking about low risk assets, if you're talking about USDC, USDT, uh ETH and these high quality assets that are very well understood, you can probably operate within uh this model.

But for these newer assets, I think we need a model that allows you to control risk a little better. Yeah I >> [clears throat] >> I think there's a couple silver linings here um that I want to sort of briefly touch on. One is that Arbitrum's freeze worked um and it set a precedent for recovery. Uh so 71 million was clawed back in real time from Arbitrum. Now, there's a separate debate about whether or not this was good or bad from a decentralization perspective, but this is the first time, I believe in history, that an L2 has successfully frozen and recovered a meaningful chunk of stolen funds after an exploit. Um and if this becomes standard practice, uh L2 security councils coordinating with law

enforcement to freeze hacker funds before they're laundered, uh it materially, I think, changes or could change the risk calculus for hackers. Um and for obviously for borrowers and lenders and um and users of DeFi. Um you know, you can't use Tornado Cash if the funds never make it off the L2. Um so about 25% of the Kelp DAO was recovered through this single action. Um another silver lining is Aave's umbrella system active, you know, it um Aave's umbrella system activated um it was successfully activated, which I think was very important and like the

protocol survived. Um and this was like the real stress test for Aave's backstop mechanism under live fire. Um and while it wasn't big enough to to cover the full deficit, I think it was something like 56 million um vault against 177 million in bad debt, the protocol didn't collapse, right? You know, 5.4 billion in withdrawals in 4 hours, 100% uh with utilization, like 20% token crash, um and Aave is still operating.

Um and I think that's pretty important. Um The system bent, but it didn't break. Uh and now Aave has real data on how its umbrella performs under extreme stress, which I think is long-term bullish for the protocol. Um Another thing is Tether helped recover um to switch to Drift for a second. Tether helped recover, I believe, 150 million from the Drift hack. So Tether's, you know, a centralized stablecoin issuer and it froze and returned almost half of the stolen funds.

Um So I think that's important um and it's an important um choke point uh where centralized actors could intervene to stop these uh these exploits from happening. J- Just for some context, umbrella is Aave's Think of it as an insurance um against bad debt and depositors who want to be, let's call it, the junior debt or the junior layer to be front and line to help recover any losses from an event like this, they get an extra risk premium on top of their earnings and post the hack, as I had on the screen earlier, uh we saw we've seen those risk premiums jump jump considerably and specifically

for wrapped ETH. Uh David, you were going to say something? Um yeah, no, I think I think that's a great clarification, Mark. Um I think Michael raised two very important points and I want to just set aside for now the one on the in uh um centralization and the intervening measures that we saw. But the other one was on Aave, the protocol, its resilience. Um I think we saw a lot of very positive things going on, but one thing it's important to highlight is that a lot of important markets in Aave as of now, they are frozen. And the issue is that when you get to 100% participation rate and 100% participation rate means that everything

that is provided as supply to uh borrow and pool is actually being utilized. So there's basically no available for you to withdraw. And that's why that's why we started to see some of these things spreading to to other pools. Um I think right now, I haven't seen it like in the last few hours, but for the past four or five days, a lot of Aave's main markets, including wrapped ETH, including USDC, including USDT, they they are basically at 100% utilization, which means that users cannot withdraw um their their funds. So there are a few important decisions that

Kelp DAO and Aave will will probably make over the next few days um in order to to restore things uh to normalcy. Some of them have already been done. Imagine that a lot of these looping uh leverage traders, they get very uh uh negatively impacted when utilization rates go go up to 100% because then then the the borrow cost basically goes up. So there has been a few interventions to alleviate the situations here. I think the wETH interest rate was at 10 plus percent. It was uh uh it was uh brought down to 3% or something like that. But it's um

it's it's also interesting to see how Aave has all these uh cushions, right? The first one is the excessive collateral that the borrowers are providing. The other is umbrella. And then the third is maybe the socialization uh Aave also has a treasury that they can opt to use if if they want to decide, but I think there's a lot going on on Aave right now. Uh I wouldn't say we're completely out of the woods. Um a lot of important decisions will have to be made. Aave will survive. Aave Aave will be just fine. I I think there is very little question about that, but over the next few days, I think we're going to see some interesting discussions there.

Yeah, I didn't mean to imply that we're out of the woods, uh David. I agree. But I do think that Ave will survive and I think the system functioned as it was intended to. And now it has a very good uh case study in how it deals with under mega stress. Um I guess the other thing I would add is you know, this is not this is cold comfort, but the attack vectors on both Drift and Kelp are now well understood, right? You know, both mega hacks exposed specific fixable problems.

Um now, it's not to say that there's not I don't mean to imply that well once we fix these two things, we're good, right? Like there's the unknown unknowns are what keep people up at night. But these were not fundamental sort of unfixable issues. Um And especially with Kelp and Layer Zero. I I agree but and now I'm more fearful, this is going to be a mouthful, I'm more fearful about the fear of fear. People are scared to put their deposits. DeFi is becoming more scary, they're calling for the end of it. And then you know, we start to have a more stagnated market.

And so I wanted to ask do we DeFi as a whole even with its you know, original Cypherpunk values, do we like these areas of backstops? I'm starting to lean towards, you know what? A circuit breaker might not be that bad for certain trading activities like we have in TradFi even if it's for like 5-10 minutes. Or I was listening to Shriram who is the founder of EigenLayer on 2024. He you know, he's he talked about restaking and the insurance side of it. But then he also talked about limiting the amount of funds that can pass through a bridge per block or per one minute. You know, it's programmable, your choice. And I feel like these simple solutions

could have prevented this this entire event from happening and for in my opinion it what is a minor trade-off because you know, like you said Michael, it was something like 300 million of our of of of Kelp's restaked ETH that was taken out. I mean, if you have to wait 15 minutes to move hundreds of millions of dollars, I think that is an acceptable trade-off and an unlikely event. But then it starts to you know, it's maybe it starts to eat away at some of the permissionless permissionless nature and the original values that this industry was brought up in.

I don't know if you you guys have any takes on it or if your thoughts on this framework has been swayed one way or another in the past couple weeks. Well, I I I started out my overview of the hacks by prefacing it and comparing it to the Bybit hack. Um and this being the largest one since Bybit. But Bybit was a centralized exchange hack. Right? So nobody said, oh, is this the end of CeFi after Bybit, right? Um and I don't think we should say is this is this the potential end of DeFi now?

Um I think you know, if you've been in DeFi as long as I have, these hacks have happened, they've reduced in frequency significantly over time. You know, I remember in 2022, we used to have a an exploit like this every single week. Um and they are they are becoming much more uh seldom. And I think actually the Drift exploit shows in one sense that they had to resort to social engineering because they actually couldn't exploit Drift otherwise, meaning through the protocol. So I think that's important.

Um but you're right to say that even though we see exploits both on CeFi and on DeFi, CeFi I think is within a framework that TradFi at least can better understand than DeFi. So when you look at DeFi exploits and you add in the relative uncertainty that TradFi has about DeFi and their relative understanding of these complex systems, it does become more problematic for DeFi.

Um and it could slow the growth of it could. I don't think it will, but it could slow the growth and adoption of DeFi by uh traditional financial institutions. >> [snorts] >> I agree with that. I think someone on Twitter or X said um a very wise thing and basically DeFi learns through failures. And that's we've been through many of them. Michael probably is the one who's most familiar with all the ones we've had over the past 6-7 years. But this is another stage and I'm pretty sure that DeFi will emerge and will come back stronger. I have uh very little question about that.

The one thing I would keep in mind though is that I do think some things will change. And this is just an evolving thought from me. But just like after the FTX crash and the FTX issue the centralized part of the industry had, the industry kind of bifurcated, right? After FTX, the industry is either either you're regulated CeFi or you are DeFi. There is this muddled ground that folks and and a lot of the users, especially the more sophisticated users, started to shun. Increasingly so, this still may be an ongoing process, but it was a big fork on that road.

I and and I don't want to say that this is this is like FTX because I think it's way less impactful for DeFi. But I do think in a similar way, I think we're going to have a fork. And the way I think about this is you either going to be sufficiently decentralized and be prepared to have users scrutinize single points of failures, which have been the causes the root causes of every single of these newest hacks. So you you either go on the fully decentralized route or you are prepared to accept a more centralized setup, maybe temporarily, that's totally fine. A lot of these protocols can say, hey, we want to start start centralized because that allow us

to move faster, because that allow us to grow faster and provide a faster UX to our clients or to our users. And that's totally totally fine. But if you are going to that route, I think your users will expect you to have circuit breakers, rate limiters, security councils and act accordingly. So I I don't think there there is necessarily a right or a wrong way to do, but I do think that the middle ground here, like oh, I'm decentralized but I lost 300 million dollars because one single signature was compromised, that I think is is the middle ground that users will start to shun away from.

That's kind of the um decentralization theater that we've been talking about. Um and maybe with the advent of Mythos, somebody can build a public dashboard to show more of these single points of failures across um the different protocols after disclosing it obviously as good people. But yeah, hopefully that's the case. Um Michael, you're going to say something and and and and in very Gen Z style while you while you share, I'm just going to scroll a leaderboard of all of the hacks that have happened all of the top hacks that have happened in DeFi over the past couple of years.

Sure. So April was brutal. But the ecosystem and DeFi absorbed two quarter billion dollar hits and didn't collapse. So that's pretty rare in terms of markets. Um it didn't require a government bailout. Um it did not require uh you know, any sort of legal change. Um it didn't require things that are accustomed in in uh in traditional finance. And it will become stronger from this.

The fixes are known and implementable. The question is whether the industry actually implements them before the next attack or just waits for the next 300 million dollar lesson. I think that they will definitely implement them. And I think that security firms are going to be on high alert and are going to be very much in demand over the next couple of months to make sure that this does not happen. And that these uh these hardening measures take place. DeFi is actually so resilient right now because there's been so many exploits that have taken place over the last 6-7 years. And after every single one of

them every protocol has gotten smarter and uh has made fixes that have made it more resilient um for future attacks. That process never ends, it will continue. Um but as Mythos as the Mythos rumors um have taught us you know, they're some of the most they're some of the largest software companies in the world with a host of zero-day exploits for 15 years in their code that no one caught before Mythos. So this is not just a problem for DeFi, this is a problem for uh software generally.

And DeFi at least has um I think the reflexivity and the agility to fix these problems quickly um in a way that I don't know if TradFi would be able to respond to as quickly. I think that's a good point. One exploit from one protocol and every single other crypto company learns from these lessons and hardens their own offerings. So, that is one advantage that I will say that DeFi has and it is and it's not it's not hypothetical like Michael, you and I have seen this play out over the years that we've been in this space. You know, it's very very very rare that the same attack works twice.

I have a question for you guys. If you were in the Arbitrum DAO, if you were a an Arbitrum decision-maker, would you vote freeze the funds or not? During the time of the exploits or currently? Would you concur with the decision that they just made or or not? I want to answer last. >> [laughter] >> You answer first, David. I have I have a view, but you answer first. Well, I I can go first. I I think they did the right thing, especially within the Arbitrum context. Um, Arbitrum is a stage one layer two. So, I think in that kind of fork that I mentioned, Arbitrum is very clear in the hey, we're early enough and

we are willing to have a few more um centralized features here to protect users overall and I think they made use of that. So, I'm I'm totally fine with that. I completely agree with that. I I do think uh and and I I would have done the same thing. I do think the world will now recognize that and stick with that view of Arbitrum for quite some time. I think that's the lesson of previous examples where we've crossed the centralization divide. Um, but but I I think it was the right thing to do. I want to be boring and also agree. Um, I shared this view back in Tornado Cash where I would rather people be upset about the principles and philosophy than people be

upset that one, they lost real money and two, this these funds are going to what I would consider a very bad state actor. So, I I I would rather the hypothetical anger over over principles versus something that's a little bit more tangible real and more immediately dangerous. 100% they did the right thing. First of all, Arbitrum's never been decentralized. Um, anyone that says otherwise is a little bit of marketing, right? Uh, we've always known that Arbitrum is a multi-sig. Um, Arbitrum is a short-term uh fixed to a longer-term larger scaling challenge that Ethereum has.

Um, Arbitrum did the right thing here for a host of different reasons. Um, but nobody is using Arbitrum, I I believe, because they think that it is decentralized. Um, they're using it cuz it's faster and composable with Ethereum to some extent. So, they 100% did the right thing. I would also argue that Tether did the right thing. And USDC, hopefully Circle, hopefully continues in the right direction and doing the right thing. Um, I think that over the next couple of years, what we need is an acceptance of a partnership between decentralized layer ones with less decentralized and dare I even say

more centralized uh protocols that live on those layer ones, bridges that that connect those layer ones and L2s. Um, less decentralized L2s. Um, and I think that is actually will strike the right balance for the foreseeable future. I don't actually see much value Well, actually okay. So, the the counterargument to what I just said is, if you're going to deposit your funds in Uniswap, you want it to be sufficiently decentralized so that Uniswap cannot steal your funds, right?

Um, but there are many ways to do that without decentralizing Uniswap, right? Uniswap is a protocol that lives on Ethereum. Um, it does not need to be as decentralized as the L1 in order for you to get comfort there. Same with Aave, right? Um, and I think the balance between more centralized protocols, uh more centralized dApps, uh living on decentralized L1s is going to be the best risk mitigation framework and partnership in the short term to to be able to fix some of these problems.

Yeah, I agree. And especially if they live in a neutral base layer, right? So, like Ethereum should be neutral. Ethereum Ethereum should be unopinionated. Ethereum should be decentralized. But I do understand that an L2 doesn't necessarily have to have these exact properties. So, maybe this is not something that was in everybody's mind when they were thinking about how different an L2 is to an L1, but this is yeah, I guess now after this this situation, it's it's one factor. Yeah.

Sounds right to me. Best of both worlds. Can I just can I just ask or raise a hypothetical here? Um, imagine if this was not RS ETH, but it was instead bridged uh wrapped Tesla stock. Okay? It was a tokenized security. How would this have been handled or what would the And let's let's assume that there was still the exploit in the bridge, it still happened. Um, North Korea got a hold of, you know, this this wrapped Tesla stock.

Um, how would this have changed? Oh, I think actually this would have been a lot simpler. Um, with a couple of assumptions. The first is that as long as the wrapped Tesla stock in an Aave pool was paired with like a centralized stablecoin like Tether or USDT or USDC, then you have a full ability to rewind this without having to rewind the actual protocol or rewind the chain, right? So, every issued Tesla stock on chain could just be burned, right? And reissued to the proper owners, all of whom

the issuer will know who they are, right? Um, the the like one of the core principles of tokenized securities will be and has been so far that every tokenized security is attributable to an owner that the issuer knows, okay? So, they could have just snapped their fingers, burned all of the wrapped Tesla stock, let's say, and there goes that. Now, if they had deposited the wrapped Tesla stock in a pool that and then borrowed USDC against it, well, Circle should do the same thing for its uh for its stablecoin or Tether should do the same thing for its stablecoin,

right? The only challenge that is raised is when I think Mark, you said it, when you can borrow a bearer token against this wrapped Tesla stock, right? In which case then, the bearer tokens cannot be burned. There is no central authority that can burn Ethereum or restrict Ethereum. That's when it gets to be a problem. But I actually think that the the introduction of RWAs like tokenized securities will make these problems less severe and more easily addressable than with bearer tokens in the current architecture.

I actually wanted to ask that same question, Michael, to the group. So, well on for well on for front-running me. Um, I I I and I and I did think about this today and I don't and the same thing like you just said. I think if it was a bearer asset which is borrowed, not what nothing could have been done. It would have just been the same bad debts on the sheets. I mean and then and then I thought in all likelihood, >> [laughter] >> I assumed the Tesla issuer or whatever it was would have backstops in place for such large movements like some of the rate limits I mentioned earlier. Um, then I also think that most likely if you were to if you were you had those Tesla wrapped Tesla shares, you would be probably be borrowing US dollars against it and probably not ETH. So, yeah, I I I

think I agree with everything you said 100%. No comments from David or Matt >> [laughter] >> on my on my brilliant hypothetical? I think I think you're just exactly right. I do think it's gets complex cuz they may in the future borrow a bearer asset against it. Uh but then it's it's sort of you can almost imagine who who bears that risk. Um, look, I think this is just generally speaking a risk that needs to be priced into the the rates. Um, and I think long-term that will that will happen.

When when the actual hack happened and I was looking at the deposits happening afterwards plus a little bit of price action. I think it was Monday morning and I saw total TVL across all of DeFi um and it is down 18 billion. And then even if I look at the Drift hack as well, not including the price increases in Bitcoin and ETH over the time, we're actually looking at like 20-something billion. And all of this time with these exploits and similar going on in the TradFi in the in the DeFi markets, real world assets were up 4% on the week. And you know, I I and I started to like this this cybersification, this lack of correlation between the two

assets and I think it's not only good for for maybe market participants, it's also good for investors because as more of as more of these tokenized assets come on chain, the revenue sources start to come from these uncorrelated correlated assets. And so I I I I tweeted out asking, you know, currently I think real tokenized real world assets that are distributed, not just represented, on chain is something like 20 7 billion, maybe 28 billion. And now after the most recent exploits, TVL across all of crypto is I think it's about maybe let's just say like 90 billion dollars around now. So I I pose the question, when do we think the the

flippening is going to happen between those two assets? Uh my guess is I'm going to say I'm I like, you know, predictions aren't fun unless you be a little bit bold with them. So I'm going to guess next year. I think that's a reasonable guess. I think it I think that's a reasonable guess. I just think the real world momentum is really significant. That seems that seems plausible to me. Depends on clarity, I think. Timing of Clarity Act. Everyone's Everyone's getting optimistic, Mike.

Come on. I don't know. I'm just saying depends. Depends. Put on the sunshine hat. Depends. Absolutely. I think last stretch. I I actually think Clarity will be one of the bigger industry themes in the next like 2 weeks or so. We're getting to the very end of that window when I guess everybody wants to see the Senate Banking markup, either last week of April, maybe first week of May. That's basically when it got to go through. And it's very very important thing from here on. Yeah. I think if Clarity gets passed, it's it's it's it's good times.

Um and I'm increasingly optimistic. It was postponed. This It was supposed to be this week and it was postponed. Am I Am I right or Um I don't I I think they might have said at some point, but I don't think it's ever it's ever been in the formal in the agenda. There there is an expectation that it's going to happen. I mean I think they have been saying that they wanted to bring it to markup by the end of April. I think that was true, but I don't think it's ever been like officially on the agenda. And most folks are kind of assuming a flexible timeline here. Last week of April, first week of May. That's probably when we're going to see it.

Seems folks are excited. Um it's This is the Senate Banking markup, right? We We already had a Senate Ag markup. It's already passed. Um on partisan on partisan line. And now we're going to have the Senate one. And that's kind of the next step we need to clear before we actually get to the floor. Well, to end it on some optimism, maybe things aren't going right in DeFi markets, but you know, my you know, last episode on stretch, we've we've moved, you know, net proceeds have increased even further. Bitcoin's at around 79k now, hitting that short-term holder realized market cap of

80k. Maybe some resistance there. Ether's mid-2000. So out outside of these the North Korean exploits, I think markets are starting to become a little bit more positive, especially with I think ETF flows picking up some momentum. And I guess Clarity would really just be, you know, the the major catalyst needed. I don't want to call it the icing on the cake because we don't have the cake yet, but I think I think you're right, David, on that. Any last thoughts from the group? Yeah, I I think I mean what one of my last thoughts on this is this is the most sophisticated uh threat actor out there, which is Lazarus Group. Um I think it's an open question about like

what are we doing about Lazarus Group? Like we assume this is like sort of I think we all just assume like there's nothing we can do about these guys. They're just going to be a permanent fixture to living online, but I don't know. It seems like uh this stuff shouldn't be tolerated at like a a global international level. Um and like we have a lot of I mean I I don't want to say we, but you know, the US government should be able to um to figure some things out there, I I would think. Because that would be a big win, not just for crypto, but for the I mean Lazarus Group has done 7 billion dollars just alone on crypto, but they've done billions more and exploits

for non-crypto companies. So it's been a real thorn in in in the global economy side. Yeah, I love that. It's a good take. I agree. We should get after it. I I want to finish on a positive note. I know it's been a tough 4 to 5 days for DeFi, but as I said before, DeFi learns through these episodes. I I have very little doubt that DeFi will emerge stronger. And I'm actually even kind of relieved that these vulnerabilities were kind of shown when we're still a relatively small market. So I think this is the next thing that maybe DeFi needed or the next wake-up call that it needed

for it to kind of keep grinding ever higher. DeFi is here. DeFi will continue to be here. A lot of the issues that we saw related to these hacks over the past few months, they're related to centralized single points of failure. We need to be able to address these things better. There's definitely a lesson here for us, but I think it's important to keep in mind that the reason why DeFi exists still very much here. DeFi, if you have ever used DeFi, you probably can see very clearly how much more efficient and how much better to use it is compared to the traditional financial system. So we're going to be just fine. It's just a rough period that we're going through.

Okay. Love you. Love to end it there. DeFi is here and DeFi will remain here. So thank you everybody for listening. Um hopefully hopefully your portfolio's up and you weren't you weren't exploited. Join and tune us in next week for the next episode of Inflection Point. Cheers.