How KelpDAO's $290M Exploit Nearly Killed DeFi | Stani Kulechov & Mike Silagadze

This episode is brought to you by Fidelity Crypto. You'll hear more about them later in today's episode. Nothing said on Empire is a recommendation to buy or sell any investments or products. This podcast is for informational purposes only, and the views expressed by anyone on the show are solely their opinions, not financial advice or necessarily the views of Blockworks. Our hosts, guests, and the Blockworks team may hold positions in the companies, funds, or projects discussed. All right, everyone, welcome back to Empire. We've been talking about KelpDAO and Aave, you know, all the craziness that's unfolded over the last 2 weeks. DeFi United, the bailout, whatever you want to call it.

And yeah, I've been talking to Stani on the side, and, you know, Mike, obviously, EtherFi stepped up in a huge way. So decided to bring them both on the podcast. We've got Mike, who's the CEO and co-founder of EtherFi, as well as Stani, who many of you already know, I'm sure, has been on the podcast many times, but, you know, founder of Aave. So Stani, Mike, welcome guys.

Yeah, great to be here. Yeah.

How much sleep have we gotten collectively in the last 2 weeks?

More in the last few days. I think it seems like the worst is over and the ecosystem kind of pulled through. So it's been better in the last little while, but yeah, it was an intense week for sure.

Yeah, I think the first day out of the breach exploit. Like, the first few days was probably the most difficult. Um, you know, it's, uh, you couldn't really sleep much for various reasons, but also because we were sort of, uh, against the time. Um, obviously now it's a little bit more easier, but, um, there's still a good amount of work to do. So, uh, yeah, running still low.

Yeah, yeah, yeah.

The thing that, um, surprised me, I guess, and, uh, and, uh, bothered me is, at least to me, it was so obvious, uh, immediately within a matter of hours that this was an existential threat to DeFi. Like, it was just the sort of like step 1, 2, 3, 4. It was like, all right, game over. Like, this is it. Uh, and so the— it was so clear that like, okay, people needed to spring into action, immediately start addressing this thing. Or else it was going to spiral. And I think, in fact, if it wasn't for the work that Stani and his team and some others have done, that was the default path. I don't think people recognize that just without that intervention, without that effort that people put in, the default path was just a complete blowup of DeFi.

Yeah, I think not everyone really understood sort of like where we were at that point in the space because like, you know, effectively this wasn't about Aave, it was about DeFi as an ecosystem in overall and how to manage this sort of like big capital movements that are done also quite programmatically. And I think that the protocols involved and the teams involved typically are really diligent. We work with them on a day-to-day basis, but when something like this happens where you sort of have a remote dependency where things happen and it creates an attack vector and affects the whole space, that's sort of where things need— everyone needs to sort of like move and figure out how to— what are actually the next steps because that's That's the first thing to figure out. And I think to Mike's credit, Mike was there at the very beginning and realized sort of like where, you know, what are the potential paths that things could go, including the extreme worst case scenarios. And realized that how important this is for DeFi. And that wasn't the case for everyone to understand at the first glance, but it sort of like helped quite a lot during the process.

Yeah. Mike, can you maybe walk us through why this was such— I'm reading your tweet here. It says, you know, FTX, he said, you know, we committed 5K ETH to the Kelp hack recovery fund because we thought there's a real risk that this could have killed DeFi. FTX would have looked small in comparison. I'm not sure if that's just a bold statement to get your tweet, you know, more viral or if that's like if you genuinely believe that. But if you— I'd really love to hear the thought process behind it?

Yeah, you know, it's, it's pretty straightforward, honestly, and I 100%, uh, you know, stand by that. Um, you know, I'm sure lots of people have read about, uh, kind of the, the high-level events that took place, but the basic idea is, you know, Kalp had a certain structure to their cross-chain, their bridging, uh, setup. Uh, they of course were using, uh, LayerZero, but they had a certain structure they decided on, and that was exploited by, you know, DPRK, North Korean hackers. And so the direct impact was about $200-some million that were stolen. But what it meant, and the default path for teams when something like this happens, is to sort of pull back lawyer up, get super defensive. And that's what was happening. That, you know, it's, it's hard to fault a team for, for doing that, right? You're in this extreme situation. You don't know what to do. Most people haven't lost $200 million before. So you don't know what you would do if, if you were placed in that, in that spot. So the default is, all right, lawyer up, pull back. Okay. What's the safest thing that you can do? Well, the safest thing you can do is declare bankruptcy. Say, all right, this wasn't our fault, we're now encumbered bankruptcy. Now, if that happens, if they had chosen to go down that path, which I think, uh, I don't want to speak out of turn, but I think their counsel was advising them very strongly to, to do this, um, uh, then it's not a $200 million problem anymore. Now it's $1.5 billion because there's $1.5 billion of RSE sitting out there. And if, you know, if, if CALP had gone into bankruptcy, that, that's, you know, that's now locked up. That $200— that $1.5 billion isn't moving anywhere for probably years, as we've seen how long these, these things take to play out. So now you have a billion and a half dollars that's stuck in DeFi, a lot of it in, you know, in AAVE markets, but also on Compound and Euler and a lot of other protocols. Every one of those protocols, uh, frankly, is now fucked because now you have a billion and a half dollars of assets that aren't going to move. So there's going to be at least a liquidity crunch because, you know, you won't be able to pull them out for, for years, which then would have had a cascade effect on the lending protocols. And every CeFi exchange has assets in, you know, various lending protocols. Tons of every DeFi protocol, you know, has assets in, in AAVE and everybody else. So this is something that it wasn't just going to impact Kelp, it was going to impact everybody. So that was the— what, what to me seemed like a clear Armageddon scenario. And again, everyone's default path was sort of to pull back, lawyer up, and, uh, and, and throw their hands up. Um, and so what I said, again to repeat, was the, the one team that really just stood up and said, no, we're gonna fix this, let's raise a recovery fund, let's, let's actually make sure that this blowup doesn't happen, was, was Aave. They, they just took their responsibility. In many ways, this was out of all, plenty of blame to go around, but out of all the parties, they were the least responsible, right? But they just took ownership and really ran with it. So that was great to see. And I think in the end, all the work combined ended up averting that disaster scenario.

Yeah, if you think about it, like from the asset perspective, like the asset itself is, it's basically backed on mainnet. So sort of like, most of the backing is there. And obviously the effect is more on alt-2s. And the kind of like, challenge is what basically Mike said is that, you know, if you choose to sort of like a tradified path of like everyone just lifts their hands up and basically takes protective measures, nothing here can be actually solved. And we saw a lot of that and we saw a lot of sort of like a direction going towards that. And from Aave's perspective, we, one path for us would have been to just focus on, okay, how do we solve this from Aave's perspective? How do we apply a haircut and call it a day and continue business as usual and register the deficit and pay that. To the protocol treasury and balance sheet and revenue and move onwards and sort of like write it off and make the protocol whole. What we realized is that there was so many stakeholders involved in this incident and protocols, LPs, different teams, cascading effects and whatnot. So we realized that actually, like if we really want to get everyone onto the same table. We need to find a sort of a conclusion that really satisfies everyone. And that is basically to go as whole as possible and find the means of doing that and figuring out how everyone can actually contribute in the most responsible way into this. And that is what sort of like the, the, the big difference here and why DeFi United was born is because it wasn't about how do we, uh, sort of like write this off or not, but how do we make this whole ecosystem whole and restore the confidence. And that confidence restoring is far more greater than any sort of like individual protocol impact. And I think where, uh, Mike and EtherFi, uh, played a huge role is that they were sort of like mediating and getting everyone on the table, pushing any sort of like lawyers out of the table. These people don't belong into Web3. And things needs to be solved between founders and teams and natively. And to Mike's and their team's credit, they were the ones that actually were taking a lot of sort of putting on the table ideas that, you know, you necessarily won't do that from a, you know, kind of perspective of like, why would you come and help other protocols and even sort of like in the same landscape where they offer similar products and doing that for the sake of restoring the whole confidence in the space. And that is very rare. I don't think that is even sort of like a solution that people think, and more in the traditional finance. And once this whole DeFi United started to actually kick in and we saw like the support, it sort of changed the whole narrative from like, oh, these teams are just pointing fingers at each other into like, okay, let's all come together and really, you know, sort of like restore I won't call it like a rescue or any sort of like a bailout because bailout is forced obviously by taxpayers and whatnot. This was more of like, hey, we all have skin in the game, we all believe in the space, and we sort of like, uh, everyone is improving their security, but we need to act now and, uh, for the— that we restore the confidence.

Yeah, Stani, you said, um, I saw one of your tweets, you said it was the hardest couple of weeks that you've that you experienced in your entire life. Was there a moment in time that you, maybe in day 1 or day 2 of this unfolding, that you thought, you know, maybe, maybe this is the thing that kills Aave?

I wasn't thinking about Aave, to be honest. I was thinking more about DeFi, um, you know, and what are the consequences of, of DeFi, because I, I do think that Aave is sort of built to be resilient. Like, when When you think about protocol building, like you optimize for that sort of like, not the 99% that works, but let's say 0.01% that things do not work. And how do you reestablish the resiliency basically? And we've always seen multiple market and credit cycles from like the 10 of 10s, the FTXs, and even in the early days of DeFi, like Black Thursdays and Mondays and whatever there was, but it sort of shows the resiliency. And for me, what was more important is to, was to understand like what actually we have to do to ensure that people have confidence in DeFi because we don't just work on smart contracts, but we do a lot of policy work. We do a lot of, you know, work with institutions and, you know, and actually institutions were the most supportive. Like we got a lot of emails from TradFi institutions that were offering help and trying to figure out how to progress because they have so much belief in the technology, even though we have more skin in the game. So that was really surprising. So I was more worried about how this affects DeFi than anything else. And I think we felt very lonely until a lot of the other sort of like stakeholders like Mike and their team came up and and sort of for like putting solutions on the table because that was like a very difficult place to be in. And you're so limited by time constraints, resources. And I think even DeFi United could have been done in various different ways. But like when you have to move fast and execute, like you really just operate on, you know, what you can do during that particular day.

This episode is brought to you by Fidelity Crypto, a platform built in-house with the same discipline Fidelity applies to everything. So you can invest in crypto confidently. Trade crypto backed by industry-leading security. Get started at fidelity.com/crypto. Crypto is offered by Fidelity Digital Assets N.A., is not insured by FDIC or SIPC, and includes risk of complete loss. Fidelity Brokerage Services LLC, member NYSE/SIPC.

Mike, why, um, Stani credited you for going above and beyond. Why was this the— I know you said it was, you know, could be FTX level, and, you know, the cascading effect could have been, yeah, I mean, really taken down DeFi. But, um, why— can you just walk me through maybe a little more detail of like how DeFi United— why you decided to make this the moment that you guys really stepped up and like how it came to be, and even other ideas I'm curious about of like what else were you guys considering solutions?

I'm probably, uh, I don't know exactly how much I can say, but I'll just err on the side of transparency. Yeah, we threw in a lot of different ideas. One of the big ones that we were talking about is just EtherFi acquiring Kelp, basically just taking on the liability. Like, it was, you know, trying to do that in the span of a week is, uh, terrifying because it's— you're basically buying a black box and you have no idea what, you know, uh, what's in there. Uh, I could have taken us down as well, but we were willing to do it. I think in the end it wasn't the right solution, but we went pretty far down that path.

Did you give them, did you make them an offer?

Yeah, we went, I mean, we were exploring like 3 or 4 different things in parallel, and this was meaning like legal docs going back and forth. So this was one of the paths that we were going down. I mean, the thing we were trying to optimize for was just like, how do we as quickly as possible get this sorted. Uh, another thing I think people don't appreciate is just how stupidly lucky we got. I mean, ETH has been basically flat for like 2 weeks, like $2,300, like on the dot. Uh, there have been a big freaking problem if ETH suddenly dropped by 20%, which happens like any random Tuesday, right? Iran starts shooting again, uh, it drops 20%, the problem suddenly gets a lot bigger, especially when, you know, explain that.

Why the problem gets so much bigger then?

Well, so in lending markets, and I'm sure Stanley can comment more on this, right? When the utilization is 100%, you can't liquidate. So that could have led to, frankly, a much worse cascade where you would have had a lot of bad debt in place. So that created this extreme time urgency because we were just like watching the, you know, this price, hoping that it didn't, didn't move, and we needed to act quickly, mostly to restore confidence. Even just making an announcement, I think, that, you know, what we were doing, uh, you know, went a long way to give people sort of a feeling of like, all right, this, you know, it's going to be, uh, taken care of. And as soon as the announcements went out, you immediately, you saw at least the stablecoin markets, uh, start kind of cooling off. Like, now there's hundreds of millions of dollars of liquidity available. The ETH market is now cooling off and lots of, um, uh, sort of unwinding taking place. So, uh, that's why I think, okay, we're, we're past kind of the worst, uh, case scenario. Um, but yeah, you know, EtherFi was in this unique position, I guess, in that we actually had no exposure. None of our vaults had any rETH exposure. Our position even in AAVE was such that we were short ETH 'Cause like the looping on our vaults is such that it uses wrapped ETH, our asset is, our staking asset is collateral and borrows ETH. So even that actually, we could easily unwind it without taking any exposure. I mean, our total cost for the increased interest rates on the ETH borrows was like something of 400 ETH. So it was not something that was, a major issue for us. But what I saw was if DeFi blows up, EtherFi can't exist. So that's why I didn't give a shit about it. Was, is it a competitor? Is it a— like, it doesn't matter. If DeFi blows up, we can't exist. Uh, therefore, like, we had to throw everything we have at it. I mean, 5,000 ETH for us is not a, a small amount of, um, uh, capital, but we, we just felt like we had to throw everything we had at it in order to make sure the that everyone pulled together. Everyone actually gathered in a room and were talking to each other to solve the problem. So yeah. And as I said, thankfully we got there.

So I also noticed that when Eterfire came out publicly, a lot of the DeFi projects that they didn't have a skin in the game were starting to actually contribute as well, which was really incredible from Frax to other ones. So it started a really genuine movement and understanding like where, like why is this so important? And I think this, it really helped to bring everyone also on the same team. I think without DeFi United and without basically my coming and actually trying to get people to solve this. I think we were in the first days, and it was a really hard situation because in one way you're dealing with raising funds, in one way you're dealing with analyzing what needs to be done for the attacker's position. On the other side, you're dealing with the sort of like human relations, and then you are dealing with the DAO. So like the the sort of focus is really difficult to keep engaged. And I think that if you believe in DeFi and what it could bring, and, you know, it's sort of a thing where everyone just comes and steps in on their own will. Obviously, there are people who don't want to support and they don't see that as a path forward, and that's totally fine. But we believe that if this technology and these protocols are going to scale in the future, we have to ensure that basically we have the stability and these markets quite quickly regain. So the challenge with DeFi is that the capital moves extremely quickly and signals move, indicate really quickly. So in Stratify, you know, there's certain bottlenecks, for example, for liquidity movement. And I think that's something that we have to think about going forward is that if you have a temporary loss of confidence, which in Aave's case basically means that there is positions liquidity available, but not at a specific time. So you have to wait the confidence to return. And for our surprise, it was pretty interesting to see that really quickly you saw stablecoin liquidity come in back and later eat liquidity and some of the participants that wanted to help, they were actually helping by supplying liquidity. So they were like betting on DeFi and betting on Arwen and the sort of like pushing the confidence that really, really actually helped. And they obviously enjoyed the higher rates than usual.

Yeah. Are there any teams that you want to call? Are the, Well, I guess there's the good and the bad. So are there any teams that you think really stepped up that you want to call out? Or I guess any teams that were frustratingly maybe absent from the conversations?

Maybe. I don't know. Maybe in a few months, maybe in a year, we can talk about that. But I think, yeah, I mean, there'd be some sort of like—

I mean, I'm not saying like, you know, for the Game of Thrones watchers, like, you know, shame, shame, shame. But like, I feel like if this is a, you know, Mike, if you're right, if this was an FTX-level event, like, you know, the people who are so—

potentially $30, $40 billion, like this.

Right. So then, so it's kind of crazy to me that someone, if it really was that scale, which I think you're right, like, shouldn't everyone have stepped up? And there weren't— there were, there were a lot of people who joined DeFi United. There are a lot more who did not.

So yeah, I mean, I guess, you know, definitely there were a lot of expletives in the Telegram chats, you know, bitching and complaining. And, um, so for sure there was frustration that, you know, one party or another didn't, uh, didn't step up as much as they could have. On the other hand, I guess, um, like, I've ran other businesses before at scale, so like, I've I've been in lawsuits. I've like, to me, I'm like, okay, I know how this works. I kind of have a playbook of what, how this turns out. So this fear, maybe just some of us are wired differently. There's less of this fear. To me, the fear of inaction was much greater than the fear of like just sort of rushing into the unknown and trying to solve the problem. Whereas maybe some of the other teams that maybe didn't step up or acted too slowly, I think it mainly, you know, came out of fear because if you, if you're facing potentially a whole bunch of lawsuits and even criminal liability in some cases, it's very easy to just lock up and freeze in the moment. And, you know, and then that's how things get worse, right? If, you know, through inaction.

Yeah, I agree. I think there were sort of like a at the beginning, a lot of selfish behavior all the way to the LP level. And I think once we got past to that, like, you know, finger pointing, because I think everyone published their sort of like, you know, reports and whatnot. And, you know, and then at the point when DeFi United was basically launched, I think that was the the pivotal moment because at that point it was about, okay, this is not about whose fault this is, who to blame. It's about basically like, you know, what are the next steps, how to restore, how to mitigate in the future and how to solve this. And I think that obviously the teams involved, including EtherFi and Lido and Athena and a bunch of other ones has been really helpful. And also teams like Mantle and even on Ethereum side, like obviously we try to reach out to everyone, you know, including Ethereum Foundation and a lot of the sort of Ethereum guardians as well. And Joseph Lubin was willing to step in as well and a bunch of other people. So It really showcases that actually there are a lot of good people in our space and willing to really help. What it means for me personally is that at least I know in the future, you know, who are the true friends and willing to step in. And also it means that how we can be helpful and step in if this happens to someone else and there is cascading effects. So how to prevent that. So I think that's the biggest win here is that people weren't too selfish and trying to protect themselves. Instead, that they turned into a mode where they're trying to figure out like, how do we solve this on-chain within the communities and in a way that really restores everyone's confidence and everyone is happy. And the happy path for everyone is 10 times harder than the happy path for Aave or happy path for EtherFi or happy path for someone else. So there was a lot of work to do there to get to that point. And also the DAO coordination was even, I never coordinated with 6 different DAOs at the same time with proposals and voting. And it's been like quite an experience.

Well, what happened with with Arbitrum, I think that's like, you could make probably a movie about this whole insane situation, right? Where Arbitrum, uh, again, I'm probably speaking out of turn, but effectively took back the money the North Koreans stole. Um, and then thankfully that was, uh, you know, through a process, uh, that money is now on its way back to, uh, to users. So that was a remarkable— I mean, um, that could have been the thing that made things turn out differently, right? If that money wasn't recovered, like that 30K ETH made the whole lot more manageable than without it. So it's— yeah, it was a pretty wild situation.

Mike, say one more thing about the Arbitrum situation. Why was it such a movie-like scenario?

Well, I mean, so North Koreans, you know, stole a bunch of ETH It was a bunch of it was sitting on Arbitrum. And so Arbitrum took— I don't know the exact details, but they took a vote. So they took a collective action to basically pull back that, that ETH. If they hadn't done that, if the North Koreans had, you know, pulled the money off of Arbitrum and then started, you know, their swaps on ThorChain or whatever they were, whatever channels they're laundering it through. That, I mean, that money would have just been gone. And now you have another 30K ETH, you know, what, $80 million to fill, which would have just made it that much more painful.

Yeah. Are we through? I know we're through the worst of it, but are we through the whole situation?

Still actions to be taken. So obviously there's bailout of the 6 DAOs. Governance proposals, there is one left on Mantle. The Arbitrum governance process is quite long, so that's another one. And Compound governance proposal as well, because obviously they have some actions there, including liquidating the attacker's position. Proposal to liquidate the attacker's position on Aave was released And actually as an on-chain vote an hour ago. So that is happening. So once that has been done, the backing starts and then everything sort of like restores and the nature heals by that time. So there's obviously that. And also I think there's a lot of work across DeFi to actually talk to a lot of, you know, teams, institutions, and whatnot, and educate about the, uh, the incident. And also a lot of teams have been taking efforts to actually improve their, um, trust assumptions toward, for example, uh, bridge infrastructures. And I think that's some— something that's been really helpful. Also a, a different multisig configurations. And I think in overall, um, the space is realizing, uh, the sort of, uh, threat that is coming from North Korea and, and basically How do you mitigate against that, especially as these exploits become very targeted? So there is a lot of sort of like work in terms of like security and education that needs to be done still there and restoring the sort of like whole confidence in DeFi.

Take a disciplined approach to crypto investing with Fidelity Crypto, a platform built in-house using over a decade of crypto experience. Experience. At Fidelity, you can trade crypto and stocks together, backed by industry-leading security. When you can see your accounts in one place, it's easier to make smarter decisions. Get started at fidelity.com/crypto. Crypto is offered by Fidelity Digital Assets, N/A, is not insured by FDIC or SIPC, and includes risk of complete loss. Securities offered by Fidelity Brokerage Services, LLC, member NYSE/SIPC.

Stani, can we focus on Aave for a bit? Because I want to talk about kind of lessons learned for the industry. And, you know, maybe there's a bunch of ideas that have been thrown around. But, you know, if you look at Aave, like the deposit, you know, your guys' deposits fell from like around 70, 75 to around, I think, 25 or 30. So, you know, obviously this like hit you guys hard. I'm curious just you know, you've been running this thing for coming up, I think 10 years now, or coming up on 10 years, like, just curious how you think about lessons learned from the Aave perspective, like where you go from here, how you think about the future.

I mean, in overall, the TVL is, is sort of a metric that isn't the most purest to measure growth factor, because a lot of the TVL, for example, comes from different business lines. So It can be lending stablecoins against Bitcoin and Ethereum, leveraging, for example, yield-bearing stablecoins, or leveraging, for example, staking yields as well. And that staking yield business is quite substantial. So when you see a deleverage momentum, that actually shows in the charts. So once the actual when the confidence picks, also the market picks up, a lot of this looping will reactivate as well. So that is interesting. But overall, what we think is, and this is more like a wider perspective, is that, you know, we have to actually expand DeFi out of existing use cases as well. I think we're sort of in that $100 to $200 billion market size that we've been in the past few years, more or less depending on the market and credit cycles. But what we truly want to achieve is that where Aave could actually be used as a whole, like a backbone of all finance and credit. So, you know, if you issue credits, you should do that directly on or indirectly through Aave. And that way we get actually more diversification for for these business models and also business models, for example, that don't depend necessarily on the native strategies that we, for example, have. So it's all about diversifying. And I think I mentioned this somewhere else is that I sort of see the future where the underwriting risk is tied more closely to the balance sheets and revenues of the DAO, meaning that In the future, it becomes even more important to be able to cover sort of like a black swan events and events that might be out of the control, but you indirectly might be underwriting that type of a risk. That is why I think strengthening the balance sheets, creating different ways to actually protect the protocol. We have the Aave native protection mechanism with Umbrella. But also coming up with different forms of insurance as well down the line. So I think that's the sort of like a future where we're heading at.

Yeah. How do you think about risk management as you guys try to, you know, if you're like credit for all of the global capital markets, like let's say this vision works out, you need, you need way more assets, right? That you can borrow and lend against. How do you think about, I think I saw a suggestion around like a formal risk matrix for new assets, like bridging risk and restaking complexity and max supply limits. Like how do you think about just the risk of of, of all these new assets?

Well, the thing is that, um, and this ties to the, the, the, the point of the, uh, tying the lending closer to the balance sheet and, uh, the sort of like, uh, kind of like balance sheet economics, is that, um, in the future, Aave should not be in the place to actually underwrite all risks. Um, you know, because obviously there's a lot of, uh, debt that is, or let's say lending businesses that's, you know, our tail end and it doesn't necessarily belong to Aave. So I'm less sort of like confident of this model of like lending as a purely infrastructure because someone needs to take the risk. So if you remove the risk management from sort of like a one layer, it moves to another layer, for example, at that point. So from Aave's perspective, it should be the prime location for prime assets. And also obviously new use cases, but from a prime standpoint up to the extent that the balance sheet and future revenue can cover these types of initiatives. So I won't see Aave, at least the Aave DAO governed pools being sort of like a free-for-all, you know, list anything you can. And partially Aave's success has been that we have been able to keep a lot of these assets that had problems or configurations, whether it's pricing or something else, out of the Aave protocol. You can still license the technology and create all sorts of markets, but where the Aave brand actually stands, it's in that sort of like a prime asset quality.

Yeah. One more thing here and then Mike, I want to jump to you in a sec is, Saun, if you're less bullish on on-chain lending infrastructure, but more bullish on, like big balance sheets, what does that actually— I mean, usually to get a big balance sheet, you go raise a boatload of capital. Like, are you going to, like, I don't know, go raise a billion dollars? Or how do you— what are your plans to kind of bolster the balance sheet?

Yeah, I think what we notice is that confidence plays a big part. On the lending infrastructure. And then if you have a model where it's sort of like, you know, there's no one taking that risk and doesn't have the skin in the game, it ends up in a situation where there is misaligned incentives and you will see sort of like arms race towards capturing more risk because of the yields, for example. And we've seen this in DeFi going on and on. But I think when you can actually pair skin in the game, balance sheets, uh, and risk management, you end up in a place where actually you make more rational and better risk decisions. So I think that anyone can use Aave's infrastructure for, uh, creating new net novel lending markets, for example. But I think that where the actual mass capital will sit in is in these large pools that are backed by protocol-native balance sheets. So that is sort of the direction we're heading.

Yeah.

Mike, how does this impact how you think about EtherFi's strategy? Because you guys are so active in DeFi, right?

So yeah, for sure. So I mean, to give context, you know, EtherFi has— we have a couple of different lines of business. We have the staking protocol. We have the DeFi strategy vaults that we call Liquid. And those obviously participate in AAVE and across DeFi. And then we've got our DeFi neobank business, which includes cards and treasury management and so forth. Underlying that is actually a lending market. And we, we hope to in the next little while migrate that to an Aave v4 instance. And so that, that very much aligns with what Stani is saying in terms of our goal is to allow users to provide tokenized stocks, commodities, different assets, more RWAs that are backed by real-world economic activity, and then be able to borrow against that and, you know, use it in kind of their financial lives. So the power of this, uh, of that kind of infrastructure is that it allows these sort of more decentralized pockets, um, that are isolated from, uh, you know, from each other instead of having, you know, one giant pool where if something goes wrong, it has this contagion effect on, on all of DeFi.

Yeah. Are there any, any suggestions that you guys have seen that you really like? Like, I saw a lot of folks talking about why don't we have insurance yet in DeFi? I have, you know, many thoughts on that.

It's too expensive.

Yeah.

It would cost you, you know, 15% a year. I think this is the problem in DeFi is If you actually look at the risk involved, you really need to be, you know, getting paid 10 to 15% a year. But what's happened is a lot of the speculative— and you used to be able to do that, but now a lot of the speculative premium has gone away just because of the nature of the market we're in, the market cycle. And so yields have compressed and now people are basically going out further and further out on the risk curve for lower and lower yields. You know, you have protocols that may be paying you 6% when really they should be paying you 30% for the risk that you're, you're taking. And I think the root cause of that, the source of that, is that everything is founded on this speculative premium. Basically, one way or another, everything is trickling down from people betting on the price of Bitcoin, ETH, and whatever else going up. And that has to change. I mean, unless that changes to where it's actual economic activity, businesses producing cash flows, that are driving this, this stuff, it's not, you know, it's never going to be— there's never going to be enough yield to cover the risk. And so today in this environment, insurance is impossible because any sane underwriter is going to charge you way more than the yield that you're getting in DeFi these days.

Yeah, yeah. I echo on the aspect that the reason why sort of where we are in DeFi at the moment is a lot of that economical opportunity comes from native crypto assets. And this is actually good because, you know, people are long on native assets, long on Bitcoin, ETH, and all these sort of important DeFi protocol tokens. So there is like a really important infrastructure there. And that's going to keep growing. But where we have to get into is basically like using the DeFi infrastructure that works really well on these native assets and expanding into traditional assets, RWAs. And I think that's— and credit, like purely like using DeFi liquidity and channeling that directly to opportunities that are in real life. Helps consumers, businesses, institutions with their funding and infrastructure particularly. That's something that I've been researching quite a lot. And then bringing those sort of like assets in a way that they can be used natively more in an interesting way. So I think we have to get into that place where we sort of have a much more wider diversity and that changes the economics for everyone. It's insurance, whether it's basic yield, the risk profiles and so forth. And because I don't think that's, you know, there is this like discussion about, you know, whether lending pools should be like maybe like isolated or shared. But the matter of fact is that if there is a confidence issue in DeFi, liquidity will move from all the protocols, um, to Bitcoin at the same time. And that creates, uh, liquidity crunches. So it's more about how do you diversify as, as wide as possible. And, uh, the AAVE Horizon market was a great example because while everything was happening, Horizon was growing at the same time because people had the confidence on this sort of lending against RWAs, um, not having the same sort of exposure in completely different asset classes. So I think that's the way to, to, to sort of like improve the economics of, of, of these instruments.

Yeah. What do you guys think about the risk of, uh, we've had more hacks this year than like ever, right? So I think we're at like $700 million on the year so far. It seems like North Korea is probably enemy number one for the industry. I'm curious, maybe Mike, just how you think about like, how do we scale this industry and how do we scale on-chain capital markets if, you know, we're trying to fight off North Korea and they're, you know, they're getting— there's these hacks every other day.

Yeah. Um, I, I don't have fully formed thoughts on this, but here is some ideas that, uh, that I've been thinking about is— and things that we're doing at EtherFi is we really need to stop the decentralization theater. Because there's a lot of things that protocols do that are done in the name of decentralization without really helping the, the aspects of it, but instead just encumbering the protocol's ability to act in emergencies. I think there's a way to preserve the non-custodial nature of DeFi protocols and true decentralization as far as decision-making, management, and how these things operate without putting in a lot of the sort of theatrics. So I do think that things like blacklists are actually good, and we're going to be implementing that because it allows you to act in case of emergency, in case law enforcement— like, believe it or not, you operate within, you know, within a, a universe of legal systems, and you have to be able to abide by them. Um, um, and other protections that come into place, uh, including ability to pause, off-chain monitoring that automatically triggers, uh, contract pauses. I think a lot of these hacks can be prevented because, like, in the end, it's not that hard to detect when all of a sudden there's an anomalous, you know, $300 million of capital that moves. It's very easy to detect that, uh, but we put in all of these, um, theatrics that prevent us from actually being able to act, um, in a, in a reasonable way. And I think there's a difference between, um, the standard to which a blockchain needs to be held to— a blockchain like Ethereum, where you, you really do need this like ultimate, uh, autonomy and decentralization— versus a DeFi protocol that has a DAO, has labs, companies that operate it, that, that just need the tools to be able to intervene when things go, go sideways. And I think the most effective protocols already do that. And I think that just needs to become a standard rather than, as I said, sort of decentralization shibboleths that, you know, people, people parrot.

So what would you actually do concretely, Mike? You would say, you know, if there's a—

put in a blacklist so that you can actually like block, like the same way that Tether or Circle or others have. Again, there's a spectrum there, but having the ability to just block addresses of malicious actors with a governance process, maybe you block it for 24, 48 hours and then it requires a vote to solidify that block ability to pause the contracts in again, extreme circumstances. I think there's half a dozen other things, but things along those lines.

What about time locks?

Time locks and time locks should be like default on everything. And we, we have them pretty much everywhere so that you can't, you know, if someone takes over your multisig, they can't just, you know, upgrade the protocol to, to pull everyone's funds. So there's certain things that just should become best practices and just become expected. And they should become part of the audit to get listed on any major, whether it's lending venues or DEXs or whatever, at least disclosure should be made around this stuff.

Yeah, I agree. The emergency responding is very critical. And there's sort of like, because I believe in the decentralization and where it helps in the permissionless sort of aspect of it. But there needs to be sort of a middle ground where you can take also faster actions as well. So I agree there. And I think a lot of the hacks that happened the past couple of months also were a lot of like key compromises. So they weren't really contract hacks itself. So I think including the the bridge exploit of the, the Kelp Layer 0 one. But I think that it's more about the Web2 security aspect. And that's something that we've recently received a SOC2 attestation. And it just showcases that DeFi is going towards also direction of trying to secure the infrastructure around the contracts. The traditional way. And that is where the weaknesses are. And the measures that these folks are trying to take to actually penetrate is unbelievable. So it's just about investing more and more resources to combat all of these things. And this is something that the oil industry has to really understand. You can't run a DeFi frontend that is built by Claude anymore. It's just asking for issues. You can't really have like a weak signing mechanisms anymore. You really have to build for scale and the worst outcome possible. Because these things will happen in the future. And the important thing is to understand how to react and how to improve the security. The space is open. So that's the beauty of DeFi, that anyone can come and build, you know, open innovation. And that's what got me here in the first place. But also the stakes are coming increasingly high at the moment. And we also try to do a lot of things in public in the sense that whatever improvements we have, we are trying to share that with the community and other teams to sort of like, raise standards across. And I think a lot of teams are doing the exact same thing.

Yeah. Um, I have a totally separate question more around investor relations, but anything else on the just KelpDAO, all of this stuff that we missed that we should talk about?

Well, I think, uh, I mean, this is probably a separate episode, uh, for you guys, but just the level of sophistication and just how terrifying frankly these attacks have been. Looking at what happened with, you know, with Drift and Kelp being the most recent ones, this isn't like, oh, they, you know, put a virus, somebody downloaded a Zoom, a fake Zoom thing and they got, took over their machine and stole their private key. I mean, these are multi-month, sometimes, you know, multi-year compromises. That are extremely sophisticated in watching these things. I mean, I think anybody that is operating the space needs to be paranoid to a very high degree just because of just how sophisticated. I mean, these are— you have an entire country where basically their top minds, their top, you know, computer science graduates are being put into a government department whose mandate is to steal money, you know, from crypto protocols. This is like in the same way that we have a Department of Health and Department of Education, they have a Department of Stealing Crypto Funds. So, and you have some pretty sophisticated, uh, uh, you know, actors in this, uh, in this entity. Um, uh, I mean, if you've read the transcripts of the, you know, there's been leaks of their, uh, their Discords and communication, uh, logs, like they're, they're treating this like a business, right? They're like, they have leads, they have, they're operating this as, uh, uh, in a very sophisticated and professional way. Um, and, uh, it just, it really raises the bar. I mean, you really need to get to a point where, um, you're almost impossible to compromise, right? Uh, to, to be able to operate in this space.

Should there be, Mike, should there be, you know, so Israel has like the Iron Dome, right? And it's a, it's attacks on it's a tax on citizens, but they, you know, you got to pay, you got to pay the, you know, your taxes, but then it goes into building this defense system. Is there like, would you impose a— I mean, it's crazy when you put it like that, like that, you know, the smartest minds are literally going into this department to then go hack crypto protocols. Should we try to build some sort of the, you know, the Iron Dome of crypto and it's a tax on any protocol with more than, you know, 10 million FDV or something?

I mean, that's Look, certainly maybe you create a security, uh, uh, council and people pay into it, uh, to be a member. In exchange, you get, you know, audits and protection. I don't know, something like that, almost like a NATO of, uh, of crypto. Um, I, I, I also, uh, I also believe that probably another strategy is to counterattack. I mean, I bet these North Korean networks are, uh, possible to infiltrate. They've got infrastructure, right? They have, uh, uh, they have tools that they use to, to manage their funds and money laundering operation. Um, it's not hard to imagine a counterattack and to pull those funds back and, uh, you know, help victims recoup their, their losses. So maybe it's— we need a vigilante group of, uh, crypto, um, uh, experts to, uh, to go after these guys.

Yeah. Yeah. Um, all right. I've got a final, maybe closing question or closing topic here, which is, um, Mike, I would say you guys at EtherFi do every single— you guys are actually the company we point to a lot when we look at good investor relations, right? You, you run your quarterly calls, you know, you do reporting, public dashboards, you generate real revenue with real users and real cash flow and real products that touch people outside of crypto. You've built an amazing, amazing, amazing business, and I commend you for that. But at the same time, the token is down like 30% right in a year. And Stani's, you know, your token's down like 40 or 50% in a year. Is there anything that you think teams can do right now to catch a bid on their token, or is it just like, this is what the bottom of a bear market looks like?

Uh, I mean, look, correlation is just 1.0 on everything. Um, you know, um, so that, that's just the nature of the market that, that we're in. Uh, trying to pick one asset versus another is almost pointless because again, everything is basically just, uh, uh, trading, uh, together. Um, I think one of the challenges that we're having is that in many ways crypto assets, tokens, DeFi protocols are not investable, at least for fundamentals-based investors. Because when you look at it, uh, you buy a token, like, what do you actually have a claim to, right? Like, you just have a meme coin with the name of the protocol in most, uh, in most cases. Um, and, you know, we've done, uh, things like buybacks. I think Avi has done some buybacks, and that has— that goes to, you know, to a certain, uh, that goes to a certain degree, uh, provides some confidence that there's a connection between the token and the the health of the protocol. But I really think we need to go further to actually create investor protections within this sort of decentralized framework that, that we have to make these assets investable. And we've already seen inklings of that. I hate to mention a competitor standing, but Morpho, you know, has announced their Morpho One framework. And I think that's, that's gone pretty well for them. Because the structure they put in where their labs company is actually owned by the foundation makes it very hard for the lab company to rug token holders, as we've seen some labs companies do. But even that, I think, doesn't go far enough. So what we're working on— and I don't want to pre-commit to it just yet— but what we're working on is an open-source framework for investor protections for token holders. We want to implement it internally first and then put it out there for others to use if they, or iterate on if they want. And that, my hope is, will bring in fundamentals-based investors. They can actually look at a protocol and say, oh wow, look, this is a great business. It's growing. It's got cash flows. It actually makes sense. There's a, there's a reason to own the token because it has some exposure to, uh, to that.

Yeah, I agree that the, the— it's sort of like a framework question. And when you look at a lot of these, uh, protocols, it's really hard to compare, even because a lot of the data isn't in a format that is very, uh, representative. Um, and I, I think EtherFi is doing a great job on actually really like putting, uh, all the pieces, uh, together And something that we've been, we're going towards as well. And I do think that the correlation is sort of something that can be solved on back of that. So like if DeFi protocols can be seen to actually, you know, for the fullest potential, not just only sort of like being limited to existing crypto assets and actually being the protocols that run, you know, a lot of the financial plumbing, the same way as like HTTP and IP protocols run the plumbing of internet, or let's say Stripe runs the plumbing of internet payments. I think we get into a place where people understand, you know, what is the sort of like direction and how do we get into a place where this technology could be used in pretty much all the, uh, financial use cases.

So maybe to tie it back to like the— this whole DeFi United and the, the recovery fund. And, Stanley, you said this, uh, that I think was a very important point, that this was not a bailout, at least in the traditional sense of a bailout, where government takes taxpayer money and throws it at some maybe failing financial institutions to prevent systemic risk. This was a market action, right? This was many independent, in many cases competing players coming together and, uh, um, and helping, uh, the ecosystem, uh, thrive and survive. Um, uh, in the same way, I think as an ecosystem, uh, the, the right approach here would be to put together some equivalent of GAAP accounting standards for, uh, protocols, uh, so that disclosures and reporting— and I know, uh, you know, you guys have actually put together some work on this, but to standardize disclosures and reporting so that people can apples to apples look at DeFi protocols and then creating, you know, a framework, you know, around value accrual and investor protections.

Yeah, I will ping you about that separately, Mike. A lot we can do together. So anyways, guys, I know, I know you guys are busy. Yeah, congrats on, congrats on, I guess, getting through a tough 2 weeks and pulling together DeFi United. And yeah, this was interesting for me to just understand, like, yeah, how big the contagion really could have been here. So yeah, hats off to both of you guys.

Thank you so much. It's been a pleasure to be here in a rough couple of weeks, but, you know, DeFi will win.

The show goes on. All right. Thanks, guys.