The DeFi sector was severely tested but showed its capacity to withstand significant stress after a $292 million cyber attack on April 18 exposed inherent vulnerabilities. According to Standard Chartered, this incident did not break DeFi, but rather bent it.
The attack, which originated from KelpDAO, spilled over into AAVE, the largest DeFi lender, after the stolen tokens were utilized as collateral to secure loans for other assets. This led to a sharp liquidity crisis, characterized by a 38% decline in deposits and a 31% decrease in active loans, a scenario the bank likened to a bank run. Despite this setback, the outlook for tokenized real-world assets reaching a $2 trillion market capitalization by the end of 2028 remains unchanged, driven by the anticipated growth in DeFi lending and stablecoin liquidity. Geoff Kendrick, the head of digital assets research at Standard Chartered, reiterated this projection, stating that despite the challenges, the potential for tokenized real-world assets to reach $2 trillion by end-2028, up from $35 billion in October 2025, remains intact.
The risk of hacks and exploits continues to pose a significant threat to the crypto sector, undermining trust in systems that rely on code rather than intermediaries. Bugs in smart contracts, phishing, and flaws in cross-chain bridges can expose large pools of assets to substantial losses, with a single vulnerability potentially triggering outsized losses. The complexity and interconnected nature of blockchain infrastructure amplify these risks, with cross-chain bridges, while enhancing functionality, also broadening the attack surface and contributing to significant losses due to intricate designs and, in some cases, weak validation.
Repeated exploits can erode confidence across the ecosystem, potentially driving users and institutions away, inviting stricter regulation, and slowing adoption, thereby making security a critical constraint on the growth of crypto. In response to the hack, AAVE and a coalition of DeFi firms swiftly committed over $300 million to stabilize the system. According to the report, this intervention helped normalize conditions, with yields easing and deposits recovering. The incident is also accelerating structural upgrades, such as AAVE’s V4 upgrade and the forthcoming Ethereum Economic Zone, aimed at reducing reliance on cross-chain bridges, a frequent target in major crypto hacks.
Meanwhile, Wall Street bank JPMorgan noted that hacks and stagnant capital levels in DeFi continue to deter institutional investment, citing the $20 billion impact of the KelpDAO exploit as an example.