Kelp Hack Exposed the DeFi Scaffolding
And it showed it's still lacking guardrails.
Happy Friday to all the explorers at the convergence. This past week was all about the repercussions of the $290M Kelp DAO hack. While it is chiefly a DeFi crisis, the exploit and its handling will impact institutions’ risk calculations as they continue to weigh whether to integrate blockchain-based protocols and rails.
Also, we are warming up our dedicated Converge X feed, so follow us here @ConvergeDefiant.
Thanks for reading,
Chris, The Defiant contributing editor and Partner at Storaker Advisory
TOP NEWS THIS WEEK
- The Kelp hack shows DeFi has a risk management problem
- Japan’s biggest financial institutions pick Canton blockchian for JGB tokenization
- DoorDash goes live with Tempo —
ALSO IN THIS ISSUE
- Singapore Gulf Bank launches live USDC mint/redeem on Solana for HNW clients
- BIS warns stablecoin regulatory gaps raise systemic risk
- UK announces payments modernization package at Fintech Week
- Tether backs UAE tokenization firm Kaio in $8M round
- Coinbase and Bybit said to be collaborating on tokenized US stock distribution
Vast commodity reserves. Locked in the ground, locked out of markets. AetherStrike tokenizes them on-chain. Every commodity. Every risk profile. Putting the real in real world assets.
The Kelp Hack Exposes DeFi’s Counterparty Risk Management Problem
Recap on the Kelp Hack
On April 18, a forged cross-chain bridge message drained $293 million in unbacked rsETH from Kelp DAO, which the attacker deposited into Aave as collateral, borrowing ~$190 million in real wrapped ETH before Kelp's emergency multisig froze contracts 46 minutes later.
The event triggered a cascade: Aave's TVL dropped by roughly $6 billion in 24 hours. A $1.89 billion USDC pool frozen at 99.87% utilization. JPMorgan estimates ~$20 billion in DeFi-wide TVL erased within days. (Full mechanics: here and here)
The verdict: DeFi is incompatible with institutional risk frameworks
Jefferies warned the exploit could prompt banks to pause tokenization deployments. JPMorgan went further: DeFi's TVL is flat in ETH terms, no organic growth, and the contagion pattern is structurally incompatible with institutional risk frameworks. The BIS, the same week, characterized DeFi lending as unsecured credit to shadow banks without prudential safeguards.
Bridging the gap
Traditional finance arrived at its operational standards through catastrophic failure, not foresight. After the 2010 Flash Crash, the SEC adopted the Market Access Rule (15c3-5), requiring broker-dealers to maintain pre-trade risk controls, documented supervisory procedures, and automated kill switches.
The Kelp exploit fits the same pattern at an almost eerie level of specificity:
- Aave's supply caps allowed a single wallet to deposit 18% of rsETH's circulating supply as collateral in one transaction, with no concentration limit or velocity check.
- Kelp deployed its bridge with a 1-of-1 verifier, single validator, no redundancy, despite explicit warnings; Dune Analytics found 47% of LayerZero applications run the same configuration — the equivalent of an industry running without peer-reviewed change management.
- Kelp's multisig took 46 minutes to freeze contracts (Knight's window was 45).
- And when the Arbitrum Security Council froze ~30,766 ETH linked to the attacker, it did so without published criteria, escalation matrix, or intervention threshold. Discretionary power in place of governance.
The path forward
DeFi gets sidelined: Institutions are already voting with their infrastructure budgets. The DTCC, Goldman Sachs, Euroclear, and others have chosen Canton’s permissioned architecture for their tokenization efforts. Some are shelving open DeFi composability as a nice-to-have in their roadmaps.
DeFi ups its game: Alternatively, I’d much rather see DeFi adopt the operational maturity traditional finance has built, painfully and iteratively, over decades. Mandatory multi-verifier minimums. Published incident-response frameworks with defined triggers. Pre-funded loss-absorption waterfalls are sized before the loss occurs, etc.
"DeFi United" with 73,700 ETH recovered, (89,500 shortfall remaining), funded by voluntary pledges from Lido, EtherFi, Mantle, and Aave's founder, is admirable solidarity and exactly the wrong lesson. The message cannot be "we come together when things break." It has to be "we had the manual before things broke." A default fund after the fact is a fundraiser.
Bottom line
Yes, DeFi is rebuilding financial infrastructure. But it shouldn’t start from scratch. TradFi's operational controls were designed to prevent 45-minute windows from turning into existential events.
What Kelp exposed is how early we still are. The risk is that DeFi matures too slowly and permissioned networks capture the convergence opportunity by default. That leads to DeFi getting the same gatekeepers and same silos, with better plumbing.
Sources: Kelp DAO exploit (The Defiant) · LayerZero post-mortem · Aave WETH partial unfreeze · Circle emergency rate proposal · Jefferies warning (CoinDesk)
BLOCKCHAINS / TOKENIZATION / RWAS
Canton: Japan’s Biggest Financial Institutions Launch JGB Tokenization POC, WalletConnect Adds Support
Mizuho Financial Group, Nomura Holdings, and Japan Securities Clearing Corporation (JSCC) this week announced a joint proof-of-concept with Digital Asset to test blockchain-based collateral management for Japanese Government Bonds (JGBs) on the Canton Network. The project is supported by Japan's Financial Services Agency through its Payment Innovation Project, and sits within Japan's existing legal framework for book-entry securities transfer.
The practical ambition is 24/7 real-time collateral transactions — a meaningful upgrade from current infrastructure constrained by business hours and manual reconciliation. The PoC will also test cross-border scenarios, examining how JGBs can move between clearing houses, institutional investors, clients, and agents across domestic and international markets. JGBs are among the widely accepted forms of eligible collateral globally, making their on-chain availability strategically significant for multilateral collateral management.
The same week, WalletConnect announced it had integrated with Canton Network, adding it to an ecosystem supporting 700 crypto wallets, 70,000 dApps, and 55.5 million users. The integration means Canton's asset pool — which the network reports at $8 trillion in tokenized assets processed monthly and $350 billion in US Treasuries settled daily — can now connect to the broader crypto infrastructure stack. WalletConnect CEO Jess Houlgrave framed Canton's privacy model as "a requirement for institutions to work at scale."
Sources: Japanese firms / Canton JGB PoC · WalletConnect x Canton
Tempo: DoorDash Is Building Stablecoin Payouts
DoorDash is building stablecoin-powered payment infrastructure on Tempo, targeting faster and cheaper payouts to merchants and Dashers across more than 40 countries. The delivery platform — which also operates Wolt and Deliveroo — has been a Tempo design partner since September 2025.
DoorDash processes transactions across three parties with different payout timing, currency, and compliance requirements in every market. Tempo's pitch is sub-second finality, predictable fees, dedicated payment lanes for peak-hour throughput, and ISO 20022-compatible memo fields for cross-market reconciliation.
The April 21 announcement went beyond DoorDash. ARQ (formerly DolarApp), serving over 2 million customers in LatAm, is migrating its cross-border payment infrastructure to Tempo, while Coastal Community Bank (a key fintech service provider) is said to be pairing institutional compliance messaging with stablecoin settlement on the network.
Tempo also launched Stablecoin Advisory, a practice that puts payments specialists, banking experts, and engineers inside client organizations to help them scope use cases, architect solutions, and orchestrate ecosystem partners — custody, compliance, on/off-ramps — to get to production faster. Visa launched its own stablecoin advisory through VCA in December 2025 on the same thesis: most enterprises don't stall on the rails; they stall on everything around the rails. Tempo is making the same bet from the infrastructure layer up.
Sources: DoorDash x Tempo (The Defiant)
OTHER STORIES WORTH YOUR TIME
Singapore Gulf Bank Launches Live USDC Mint/Redeem on Solana for HNW Clients
Bahrain-licensed digital wholesale bank SGB launched a live stablecoin settlement service for corporate and HNW clients (minimum $100K), enabling direct fiat-to-USDC conversion on Solana within its SGB Net clearing network — with USDT, USDe, and USDG support planned. A Circle Alliance Program member, SGB is waiving gas and bank fees for a limited launch period.
BIS Warns Stablecoin Regulatory Gaps Raise Arbitrage Risk and Systemic Vulnerabilities
The Bank for International Settlements cautioned this week that diverging national approaches to stablecoin regulation create openings for regulatory arbitrage, and that stablecoins’ growing integration with mainstream finance raises systemic risks — particularly around reserve liquidation under redemption pressure, bank funding costs, and monetary sovereignty in economies more exposed to foreign-currency stablecoins.
UK Announces Payments Modernization Package at Fintech Week, Appoints Digital Markets Champion
HM Treasury unveiled a package to modernize UK payment services regulation at London Fintech Week: a unified regulatory framework for traditional and tokenized payments (including stablecoins and tokenized deposits), new FCA powers over Open Banking, and plans to regulate AI agent payments. Former FCA interim CEO Chris Woolard CBE was appointed as the government’s Wholesale Digital Markets Champion to drive tokenization adoption in UK wholesale markets.
Tether Backs UAE Tokenization Firm Kaio in $8M Funding Round
Tether invested in Kaio, a UAE-based tokenization platform targeting Emirati private funds and real assets, as part of an $8 million funding round. The investment extends Tether’s growing strategic footprint in the Gulf’s fast-developing digital assets ecosystem, where sovereign wealth and family office capital are increasingly seeking on-chain exposure.
Coinbase and Bybit Said to Be Working Together on Tokenized US Stock Distribution
Coinbase and Bybit are reportedly in discussions to collaborate on the tokenization, custody, and distribution of US equities, per CoinDesk. The partnership would bring tokenized US stocks to Bybit’s international user base using Coinbase’s custody infrastructure — a significant pairing given the regulatory scrutiny Bybit has navigated in recent years.
Converge is produced by The Defiant. This briefing is for informational purposes only and does not constitute investment advice. thedefiant.io
Free newsletters
Good reporting. Delivered.
Choose your coverage: crypto and DeFi, the future of finance, or both.
Free. Unsubscribe anytime.
