Key Takeaways
- Michael Egorov says recent DeFi hacks like the KelpDAO exploit were completely preventable due to centralized single points of failure.
- He calls for new industry-wide safety standards, with foundations and projects sharing best practices to reduce risks and build trust.
- Lazarus Group’s massive attacks in 2026, which have already stolen over $575 million, highlight the urgent need for collective security improvements.
Another week, another exploit—and another round of explanations that everything was “working as intended.”
For Curve Finance founder Michael Egorov, that pattern is no longer acceptable.
In a blunt and widely shared post on X, Egorov argued that many of DeFi’s most damaging failures are not edge-case bugs or unavoidable risks.
They are, in his words, “absolutely preventable.” And unless the industry changes how it approaches security, those failures will keep happening—undermining trust at the exact moment DeFi is trying to reach mainstream users.
His warning comes as the sector grapples with a fresh wave of attacks, including the $292 million KelpDAO exploit and a string of incidents tied to North Korea’s Lazarus Group.
Together, they point to a deeper issue: not just isolated vulnerabilities, but systemic weaknesses that repeat across protocols.
“Absolutely Preventable”: Egorov Calls Out DeFi’s Weak Points
Egorov didn’t mince words.
He reaffirmed his long-held belief that “DeFi is the future of the World Financial System,” but warned that the industry is damaging itself by tolerating avoidable risks—especially those tied to centralized infrastructure.
The KelpDAO exploit, which unfolded on April 18, became his central example.
Attackers drained roughly $292 million in rsETH through a LayerZero bridge vulnerability.
The impact didn’t stay contained. It spread quickly to Aave, the largest DeFi lending protocol, where users suddenly found themselves unable to withdraw funds after rsETH collateral became effectively unusable.
What followed, in Egorov’s telling, exposed a deeper problem.
- Aave said it was operating as intended.
- rsETH pointed to the bridge as the issue.
- LayerZero said its system was functioning correctly.
Yet users still couldn’t access their funds.
“Are we the industry of clowns?” Egorov wrote, capturing the frustration many felt as responsibility appeared to diffuse across the stack.
To him, this wasn’t a case of unpredictable failure. It was the result of design choices—specifically, reliance on single points of failure such as centralized verifiers, RPC nodes, or bridge infrastructure.
When those points break, the effects cascade across multiple protocols.
And by the time teams start assigning blame, the damage is already done.
A Wake-Up Call for Mass Adoption
Egorov framed the issue in human terms.
He asked readers to imagine an everyday user—a “grandma,” as he put it—placing her life savings into a protocol like Aave, only to wake up unable to withdraw them.
From the outside, every system involved appears to be functioning. From the user’s perspective, nothing works.
That disconnect, he argues, is where trust breaks down.
For DeFi to move beyond early adopters, it has to close that gap.
And that means preventing failures before they happen, not explaining them after the fact.
From Criticism to Coordination: Egorov’s Proposal
Egorov’s post didn’t stop at critique. It outlined a path forward.
At its core is a simple idea: the industry needs shared safety standards.
Rather than each project learning the same lessons in isolation, he called for coordinated efforts across developers, auditors, and risk teams to define how DeFi systems should be built and secured.
He suggested that organizations like the Ethereum Foundation and Solana Foundation could help bring ecosystems together to establish common principles.
The measures he highlighted are practical:
- Reduce single points of failure wherever possible.
- Split trust when centralization can’t be avoided.
- Share best practices for configuring critical infrastructure.
- Strengthen code review and auditing processes.
Applied consistently, these steps could shift DeFi from reactive crisis management to proactive risk reduction.
In the case of KelpDAO, for example, a multi-verifier setup might have prevented the exploit path altogether.
Better shared standards around collateral risk could have limited exposure on platforms like Aave.
Lazarus and the Rising Cost of Inaction
If Egorov’s warning needed urgency, 2026 has provided it.
The Lazarus Group, a state-backed hacking unit linked to North Korea, has already played a central role in this year’s largest exploits.
The KelpDAO attack alone accounted for $292 million. Earlier in April, attackers drained roughly $285 million from Solana’s Drift Protocol.
In less than three weeks, that’s over $575 million tied to a single actor.
These are not simple attacks.
They increasingly target infrastructure—bridges, oracles, and network dependencies—rather than isolated smart contracts.
In the KelpDAO case, attackers compromised RPC nodes and exploited failover mechanisms, turning a design weakness into a large-scale breach.
Security researchers have warned that such actors may already have deeper access across the ecosystem, potentially positioning themselves inside projects over long periods.
A Test for DeFi’s Next Phase
Despite the severity of recent events, Egorov’s message is not fatalistic.
He sees the current moment as a turning point, a chance for the industry to mature.
Each exploit exposes weaknesses, but it also reveals what needs to change.
The question is whether DeFi can act collectively, or whether it will continue to repeat the same patterns under different conditions.
The stakes go beyond individual protocols.
Every major incident chips away at confidence, drains liquidity, and reinforces the perception that crypto remains unpredictable.
At the same time, each successful response, whether through better design, faster coordination, or stronger standards, moves the ecosystem closer to stability.
Egorov’s call is ultimately about that direction.
DeFi, he argues, can still win. But only if it stops treating preventable risks as unavoidable, and starts building like the next wave of users actually depends on it.
Prashant Jha is a seasoned crypto journalist based in Delhi, India, with a Bachelor’s Degree in Computer Science Engineering. Passionate about the evolving world of blockchain and cryptocurrencies, he has been a dedicated voice in the industry since 2018. Prashant’s expertise lies in regulatory reporting, where he unravels complex legal and financial developments with clarity and precision. Before joining CCN in 2024, he honed his craft at Cointelegraph, establishing himself as a trusted name in crypto journalism.
His coverage spans major industry events, including the high-profile collapses of FTX, Three Arrows Capital (3AC), and LUNA, offering readers insightful analyses of their regulatory and market implications. Prashant’s technical background enables him to bridge the gap between intricate blockchain technology and its real-world applications, making his work accessible to novices and experts.
Beyond his professional pursuits, Prashant is an avid music enthusiast, often exploring diverse genres to unwind. A sports lover, he has a particular passion for cricket and frequently engages in discussions about the game. His multifaceted interests and sharp journalistic instincts make him a valuable contributor to CCN, where he continues shaping the crypto landscape's narrative.
