KelpDAO’s $292 million rSETH exploit came at the wrong time for DeFi. About $10 billion left the sector this weekend, after confidence was already shaken by the Drift Protocol breach on April 1 and the Venus post-mortem in March.
That combination makes the problem of DeFi harder to ignore. Open DeFi is still alive, but is losing the argument of being the default gateway to on-chain finance. Stablecoins, tokenized Treasuries and regulated settlement rails continue to proliferate, while permissionless protocols continue to absorb the trust discount.
A hack scoreboard circulating on X reflects the mood.
Some incidents are well documented. Some remain live situations. Some blur the line between protocol exploitation, bridge failure, and user compromise. The safer route is to anchor the piece to the verified failures of 2026 and the competitive shift they expose.
This moment feels different than 2021. Back then, DeFi sold the market on openness, speed, and composability. In 2026, those same qualities are still important, but they no longer automatically have narrative prestige.
Every major exploit increases the cost of trusting the stack, while the safest and fastest growing corners of on-chain finance increasingly resemble payment rails, government bond wrappers, and regulated tokenized products rather than reflexive token ecosystems.
The live test is whether open DeFi can rebuild trust quickly enough to maintain the default front-end state. At the moment the sector seems more tight than finished.
DeFi’s security issue now trumps the smart contract
The easiest mistake after a major exploit is to treat every failure as a new smart-contract bug. Drift’s loss of approximately $285 million is a good example of why that frame is becoming outdated.
Chainalysis described a breach built around privileged access, pre-signed administrative actions, and bogus collateral, rather than a simple line-by-line contract failure. The market has learned another lesson about how much DeFi risk now lies in governance paths, signing workflows, and operational complexity.
That detail changes what users are asked to trust. Audits and proven code are still important, but they do not cover the entire path from signer to bridge, from oracle to market configuration. Once the system includes multiple chains, boards, liquidity platforms, and collateral wrappers, the attack surface grows faster than the language around decentralization.
Venus’s own autopsy shows another version of the same problem. The attacker borrowed approximately $14.9 million against an inflated THE position and left the protocol with just over $2 million in bad debt. That wasn’t the same failure mode as Drift, but the conclusion for the reader was similar. A major DeFi platform could still be pushed into emergency accounting around scarce liquidity and structural edge cases.
Then came the weekend shock from KelpDAO. The exploit was serious enough to cause approximately $10 billion in withdrawals in DeFi and force freezes on rsETH-linked markets, according to Crypto. Even if that outflow estimate changes as conditions improve, the signal is clear. Users saw the complexity of the chain, uncertainty about collateral and potential contamination, and subsequently withdrew capital.
That response is consistent with the broader security trend that TRM outlined in its 2026 crime report summary. The company said infrastructure attacks accounted for the bulk of hacking losses in 2025, surpassing smart-contract exploits.
DeFi’s trust problem is becoming increasingly difficult to quarantine as the industry defends the entire operating system around the code, not just the code itself.
On-chain financing is still growing, just in more secure packages
The capital base tells a different story than a pure collapse story. A Crypto report from April pointed this out $USDT had reached a market cap of $185 billion and $USDC had reached $78 billion.
The same report cites figures from DefiLlama showing Tron at $86.958 billion in stablecoins and Solana at $15.726 billion.
DefiLlama’s Ethereum chain page also shows where the deepest open DeFi capital still resides, making the current setup look more like concentration than abandonment.
The rotation is even more pronounced in low-volatility yield products. RWA.xyz’s Treasury dashboard shows $10.9 billion in tokenized US Treasuries and 55,144 holders as of March 12, 2026.
The user who takes risks there still opts for blockchain-based settlement and ownership rails. What that user is rejecting is the idea that open-ended DeFi complexity deserves an equal share of the balance.
A quick way to visualize the split is as follows:
The split is hard to miss. Capital is moving toward products that look easier to read, offer more collateral, and are more institution-friendly.
That’s why Visa’s 2026 stablecoin strategy note deserves attention. Visa said its stablecoin supply grew more than 50% in 2025, reaching $274 billion in December, up from $186 billion a year earlier. It also framed 2026 as the year institutions will need an actual stablecoin strategy. That is the language of a market category that is being normalized.
The same pattern occurs in settlements. In December 2025 $USDC Announcing a settlement, Visa said monthly stablecoin settlement volume had exceeded its annual run rate of $3.5 billion.
The specific number is smaller than the broader stablecoin market, but the institutional significance is greater. The regulated financial plumbing moves up the chain without requiring the full cultural package that DeFi used to sell.
The battle is now over as to who owns the rails
A recent one Crypto analysis clearly identified the competition problem. Regulated platforms are chasing an on-chain capital pool of more than $330 billion, including approximately $317 billion in stablecoins and nearly $13 billion in tokenized US Treasuries.
That capital will continue to look for speed, programmability and 24-hour settlement. The broad overview of the live market reinforces the focus on the largest assets and rails rather than the long tail of governance experiments.
That’s where the comparison with 2021 becomes stark.
In the earlier cycle, DeFi could claim that it was as much about the infrastructure as it was about the product. It was where innovation lived, where revenue lived, and where users went if they wanted to see the future arrive early. In 2026, more of the future will be packaged in ways that leave out the messier parts of that proposal.
Tokenized funds can provide 24/7 movement and faster settlement. Stablecoins can handle payments and treasury transactions. Institutions can leverage these benefits while maintaining tighter control over compliance, counterparties and market structure.
More than 80 crypto projects had formally closed or started winding down in the first quarter Crypto project closure report. That number encompasses more than just DeFi, but it still reinforces the point that capital is becoming less patient with products that cannot demonstrate sustainable utility, returns, or sustainable distribution.
Crypto ETFs belong in that context. At the product level, regulated options are now absorbing more attention and capital, as users and institutions gravitate toward rails that offer blockchain benefits without requiring full DeFi trust assumptions.
That leaves DeFi playing a smaller but still meaningful role. Open composability and permissionless experimentation still matter, especially as a research laboratory for new financial primitives before more secure wrappers absorb demand.
The latest evidence describes a crisis of confidence.
Open DeFi is losing narrative leadership and may lose status as a standard front-end unless it can rebuild trust, sharpen operations, and prove that the added complexity delivers something irreplaceable.
The current debate now is who will capture the next wave of demand in the chain, and the safer wrappers are winning the race.