A recent $292 million exploit on April 18 has highlighted systemic risks in decentralized finance, but the sector has shown it can withstand significant challenges, according to Standard Chartered. The bank describes DeFi as "bent, not broken" following the attack, which affected KelpDAO and spilled over into AAVE, the largest DeFi lender. The incident led to a sharp decline in liquidity, with deposits and active loans on the protocol dropping by approximately 38% and 31%, respectively, in a dynamic akin to a bank run.
Despite this, Standard Chartered still expects tokenized real-world assets to reach a $2 trillion market capitalization by the end of 2028, driven by growth in DeFi lending and stablecoin liquidity. The bank's head of digital assets research, Geoff Kendrick, wrote, "We still project that tokenised real-world assets will reach a market cap of $2 trillion by end-2028, up from $35 billion in October 2025." Hacks and exploits remain a significant risk in the crypto space, undermining trust in code-based systems and exposing large pools of assets to potential losses. The complexity and interconnectedness of blockchain infrastructure amplify these risks, particularly in cross-chain bridges, which have been linked to billions of dollars in losses due to design flaws and weak validation. Repeated exploits can erode confidence in the ecosystem, pushing users and institutions to the sidelines and potentially leading to tighter regulation and slower adoption.
However, the swift response by AAVE and other DeFi firms, committing over $300 million to stabilize the system, has helped to normalize conditions, with yields easing and deposits recovering. The incident is also driving structural upgrades, including AAVE's V4 upgrade and the forthcoming Ethereum Economic Zone, aimed at reducing reliance on cross-chain bridges.
Meanwhile, Wall Street bank JPMorgan notes that persistent security flaws and stagnant capital levels in DeFi continue to hinder its institutional appeal, citing the $20 billion impact of the KelpDAO exploit.