DeFi and TradFi are collapsing into one capital-allocation layer, and the biggest venues in finance are folding into a handful of onchain allocators who hold the deepest liquidity like @SkyEcosystem, @aave, @ethena.
Every other structured product will be the foundational layer.
None of them is just a stablecoin or a lending market anymore. They're becoming crypto's wholesale banking layer. Whoever assembles the deepest liquidity, the sharpest allocators, and real distribution into one system wins.
Two ways I see teams building it.
1) modular and decentralized: a central balance sheet issues the liquidity and sets the risk envelope, while specialized, externally-run desks plug in, each with its own mandate and limits, all drawing on the shared book. A universal bank. One balance sheet, many desks. @SkyEcosystem shipped this first. @aave is bringing it to the deepest liquidity in DeFi.
2) centralized then converging: one team allocates the whole book itself, then externalizes as it scales. @ethena.
Sky has run the model for ~18 months. Sky Core issues USDS and owns the risk framework. Sky Agents borrow USDS up to a governance debt ceiling, deploy their own strategy, and compete on risk-adjusted return that funds the Savings Rate.
- @sparkdotfi owns DeFi yield (~$12B).
- @grovedotfinance owns institutional credit (~$2B).
- @OseroHQ own fintech/ institutional plugins
- 4) Onchian Prime Brokerage via Spark Prime +
@ArkisXYZ
- Now expanded to other leaders like @maplefinance, @Securitize, @centrifuge, @daylightenergy, @USDai_Official, @RiverFND via @obexincubator
Each the best in its lane, all on one balance sheet inside one risk envelope. The allocator OS Maker pioneered, $9.2B USDS later.
@aave V4 shipped the same architecture with V4. A Liquidity Hub holds the capital and the accounting. Spokes draw a credit line against it and set their own collateral, risk, and liquidation rules.
- A team launching a spoke inherits Aave's liquidity on day one instead of bootstrapping deposits.
- Think of it as a supranational bank allocating capital to regional facilities.
@StaniKulechov is right that it's powerful. Hub = Core. Spoke = Agent. A credit line is a debt ceiling.
@ethena is the centralized path, mid-pivot. Perps are down to ~11% of USDe's backing; the rest is institutional lending and CLOs.
- It still allocates from the center, but it's already routing USDe into @sparkdotfi's Liquidity Layer and tranching the yield through @strata_money on top.
- Centralized today, but looks more like converging on the same hub-and-spoke tomorrow.
Here's what's actually flowing through all of it. Crypto-native yield compressed, so the real spread now comes from real-economy credit, structured and distributed onchain. The biggest names in TradFi credit are already here:
- @JHIAdvisors ($480B) put its ~$27B AAA CLO ETF onchain as JAAA via @centrifuge. It now sits in both Sky's and Ethena's reserves.
- @apolloglobal ($785B) tokenized its diversified credit fund as ACRED via @Securitize, with Coinbase Asset Management and Kraken among the buyers.
- @HamiltonLane ($956B) put its senior credit fund onchain via @Securitize, live across five chains.
- @Figure has originated $20B+ of private credit, the largest non-bank HELOC lender in the US, now public on Nasdaq.
- @galaxyhq structured a ~$50M onchain CLO with @grovedotfinance.
- @3janexyz flips the direction: onchain dollars funding US fintech lenders. A $10M warehouse with LendSwift, ~$8.5M of Slope's SMB receivables, and a $50M forward-flow line, all through bankruptcy-remote SPVs. Securitization, rebuilt onchain.
And it's early. As per, @RWA_xyz, tokenized RWA is ~$31B, onchain private credit at $5.5B, against a $3T TradFi private credit market. The pipe is tiny. The flow just started.
The hub is the bank. The agents are the desks. The inventory those desks now trade is Wall Street's credit.
Sky built the first one. Aave is building it. Ethena is following soon.
1/ The EF App Relations team is putting out an open RFP for a neutral DeFi risk intelligence aggregator.
Public good, open source, no composite scoring. If you're the team to build this, applications close June 15.
Apply here: https://t.co/vvbZiEBH4h
Here's how we got here 👇
i have been incredibly humbled by the inability of fantasy top, friendtech and consumer crypto apps to cross the chasm. crypto in its most ambitious form (of ushering in a new era of user owned software and infrastructure) has failed.
we optimistically tried to blend the personas of investor (people allocating capital to production to receive more money than they put in) and consumer (people willing to pay more for a product than it costs to operate) and found ourselves serving the needs of neither.
where the strong form of crypto failed, the weak form (of commoditized ledger/database tech for financial transactions) has succeeded beyond anyone's expectation. the consequence is that crypto has been reduced to a vassal of traditional finance, both more impactful than any normie anticipated, and deeply disappointing in structure to crypto OGs. reducing global transaction costs as commoditized ledger/database technology reduces drag on global GDP, but this is a marginal improvement over the status quo and one where the value accrues in large part to incumbent intermediaries in reducing overhead and improving margins.
crypto was supposed to be the most egalitarian thing ever. it was insanely ambitious and, if it worked, could have really changed the fabric of society.
it didn't. it's over. we haven't found the right primitives, and, more importantly, the right culture for delivering the most ambitious version of crypto. it's time to question everything again.
I have mixed feelings about this cycle 😐
On one hand, crypto is finally going mainstream:
> Fintechs are using stablecoins for cross-border settlement
> Regulatory clarity will unlock yield bearing products
> Tokenized RWAs are bringing offchain yield onchain
> Institutions are increasingly allocating to digital assets and ETFs are accelerating adoption
On the other hand, TradFi is re-entering as the middleman:
> The line between banks and crypto exchanges is blurring
> We built DeFi to disrupt banks, however, now banks come back and use DeFi on our behalf. For me, this feels like a failed revolution
Top 10 Protocols by Holder Revenue in Last 30 days
Holder revenue is the money that actually flows back to token holders - not total fees. Still, the share returned through four channels: token burns, buybacks, fee distributions to stakers, and validator/staker income on chains.
• @CantonNetwork - $63.9M
• @HyperliquidX - $52.5M
• @trondao - $31.2M
• @edgeX_exchange - $19.9M
• @Pumpfun - $17.8M
• @ethereum - $7.6M
• @chainlink - $4.6M
• @AerodromeFi - $4.1M
• @OREsupply - $2.9M
• @Uniswap - $2.9M
Chains like Canton and Tron top the list because 100% of their fees flow straight to validators, with no protocol layer skimming the top. Meanwhile https://t.co/daGxWtyoMM's holder revenue fell 36% in 30 days as Solana memecoin activity cools.
Data source 🔗 @DefiLlama
Just met with a digital assets lead of a Tier 1 bank in NYC, here's the top takeaways.
1. They are "all-in" on stablecoins for payments and wanting to build fintech applications on crypto rails. Its a very clear usecase and easy sales pitch to most of their divisions internally and the value prop is easy to see: 24/7 global payments for a fraction of the cost of a wire transfer. Easy.
2. They are not thinking about perps and Hyperliquid. Not one bit. Perps and trading onchain is something that they understand is coming, specifically 24/7 markets, but when I brought up Hyperliquid, Lighter, Variational, was not really in their scope.
3. They are however interested in tokenization and see it as a credible threat to their business as it stands.
4. CLARITY worries them, and they are just *now* taking stablecoins seriously. Why? Well, of course, because the worry of losing customer deposits.
5. They are actively investing serious amounts of capital into fintech teams and neobanks, albeit they are very early and still trying to figure it all out.
crypto is no longer one industry —
it's at least 4:
1. stablecoins + payments
2. Bitcoin, crypto asset class
3. tokenization + onchain financial services (defi)
4. blockchain infrastructure
they are of course inter-related. but increasingly divergent in context
which is part of the mixed vibe right now
Am I missing something??
I just found out Unitree is about to IPO in China at just a $7B valuation.
This seems dirt cheap.
For context, they are literally the only profitable humanoid robotics company on earth right now.
And this will be the largest humanoid robotics IPO ever attempted.
Look at their actual business:
> 5,500 humanoid robots shipped last year
> $235M in revenue (+335% YoY)
> $90M in profit (+674% YoY)
This is the first time anyone in humanoid robotics has been profitable at this scale.
Now compare that with the rest of the humanoid field...
UBTech ran the world's first humanoid IPO back in 2023 on the Hong Kong exchange. It trades at $7.1B (just above the market cap Unitree is filing at).
Difference is UBTech shipped 1,079 humanoids and lost $100M last year. Unitree shipped 5,500 and made $90M.
Boston Dynamics has been around 30+ years without turning a profit.
Tesla Optimus is prototype-only.
1X and Agility Robotics are both still pre-profit.
Figure AI, the most-funded American humanoid company, raised at a $39B valuation last year. And they're still pre-revenue.
And Unitree filed at $7B with $90M+ in actual profit.
The profitable Chinese leader is being priced at less than one-fifth of an unprofitable American competitor.
And on top of all that...Western humanoids are still trying to break $30K per unit.
Unitree's cheapest humanoid retails for $4,290.
So yeah $7B seems dirt cheap.
But I guess we'll find out soon.
Thrilled to finally announce what we've been working on at Grove Labs.
One of our key learnings from running the $1B @SkyEcosystem Tokenization Grand Prix in 2024 was that liquidity for RWAs, even for the lowest risk assets such as US Treasuries and MMFs, was effectively non-existent.
For onchain finance and RWAs to scale, we need institutional scale instant liquidity for RWAs that stablecoin-native onchain businesses can depend on, every day, at any time.
Grove's first product, Basin, is what we built to close that gap.
We are excited to be working closely with a number of institutional launch partners that will make this vision a reality:
- Asset Management Partners: @BlackRock@JHIAdvisors
- Tokenization Platforms: @Securitize@centrifuge
- Access Partners: @FalconXGlobal@Anchorage@galaxyhq
We anticipate that Basin will go-live next month, subject to Sky Governance approval. Follow @grovedotfinance for the latest, we have a lot of exciting developments in the pipeline!
Such a great episode (https://t.co/BwTNsET5CL) from @profgalloway !
Quite a few points struck me ⚡️
> There’s no real villain in the tech industry, Sam Altman is not. They are just founders opting for shareholder interests. What we need is smart ppl who define regulation rails to keep them in place
> The most useful skill for success is the ability to endure rejections
> 50% of spending in the US is top 10%, and the top 1% have some sort of bunker or go-to plans when things go ugly. The top 1% are not on the side of the 99% and they did not invest in America for good. 🧐 I should say that it is a universal problem
> With openweight or lightweight models from China and AI models converging, there is a one in three chance that AI ends up being more like vaccines than e-commerce or social, and it’s gonna be impossible for a small number of companies to capture all the shareholder value they are raising money at
> Finding your purpose in life is finding that thing that you can never get a real positive return on: build real relationships, build a family, be humble and help talented young ppl etc.
The Credit Suisse/Archegos blowup was a TradFi infinite mint hack, which just played out over months instead of blocks
DeFi's transparency is a feature here, not a bug
Full conversation on @unchained_pod with @dunleavy89 and @laurashin:
https://t.co/8m0fvS5sUf
The rsETH dust is settling.
And the liquidity tells an interesting story.
Over the past week, capital didn't just run; it rotated. Here's where it went:
Lending is quietly ripping
While Aave bled -14% TVL under the weight of bad debt exposure, the rest of lending surged:
- @sparkdotfi +17% → $5.2B TVL
- @Dolomite_io +35%
- @maplefinance +22% → $1.7B TVL
No one's talking about risk curators winning.
- @SentoraHQ+33% → $1.55B TVL
- @Rockaway_X+23%
- @kpk_io +246%
Liquid staking is catching the flight to safety bid
Liquid restaking is bleeding, while traditional LSTs aren't. The spread between them will widen as the rsETH saga drags through governance.
$stETH is the cleanest expression of this trade. $LDO is the levered version.
Some trade thesis:
Long $LDO as a flight-to-safety LST narrative.
Long $SPK with Sparklend eating Aave's displaced TVL.
Long $MPL private credit attracting derisking capital.
Also watching $ENA, as TVL is down 28% in 7 days, and USDe supply is contracting.
@PaulFrambot The current DeFi yield, given the associated risks, is not appealing to institutions.
Besides tokenisation, I am curious to know more the use cases that institutions are bullish on in the current cycle, and who is moving forward actively.
Two days ago, Kelp DAO suffered a $292 million exploit, the largest DeFi hack of 2026. The attack is elegant in its simplicity, terrifying in its implications, and a case study in how a single misconfiguration can cascade through the entire DeFi stack.
▶ The Setup
Kelp is a liquid restaking protocol. It creates rsETH -- a liquid token representing ETH restaked on EigenLayer. DeFi being DeFi, users want these tokens available across multiple chains. So Kelp uses LayerZero, a cross-chain messaging protocol, to bridge rsETH between networks.
The core idea behind any cross-chain bridge is straightforward:
- A user locks (or burns) tokens on Chain A
- An oracle observes and verifies that transaction
- The bridge mints an equivalent amount of tokens on Chain B
LayerZero's oracle mechanism is its Decentralized Verifier Network (DVN), a set of independent verifiers that must agree a cross-chain message is legitimate before it is executed.
The critical word here is "independent." And that's where things went wrong.
▶ The Vulnerability
For reasons that remain unclear, Kelp had configured a 1-of-1 DVN setup. One verifier. No redundancy. No independent confirmation. LayerZero had explicitly warned against this configuration. Kelp ignored the warning.
A single point of failure in a system securing hundreds of millions of dollars.
▶ The Attack
The attackers, preliminarily attributed to North Korea's Lazarus Group, didn't need to break any smart contract. They went after the infrastructure layer.
To verify blockchain state, a DVN relies on RPC nodes, the servers that synchronize and serve blockchain data. The attackers compromised two RPC nodes used by Kelp's lone DVN, then launched a DDoS attack against the remaining healthy nodes, forcing failover to the poisoned ones.
From there, it was trivial. The compromised RPC nodes presented a fabricated blockchain state to the DVN, pretending that 116,500 rsETH (~18% of total circulating supply) had been legitimately deposited on the source chain. The DVN, seeing no contradicting signal from any other verifier, approved the message. The attacker retrieved 116,500 rsETH freshly minted on the destination chain.
▶ The Liquidation
The attacker deposited the stolen rsETH as collateral on Aave V3 and Compound V3, then borrowed approximately $236 million in (W)ETH against it. By the time lending protocols reacted, freezing rsETH markets, halting new deposits, restricting withdrawals, the damage was done.
Aave now carries an estimated $177-196 million in bad debt. Its TVL plunged from ~$26.4 billion to ~$17.7 billion as panic withdrawals exceeded $5.4 billion. Whether Aave's safety module can fully absorb the loss remains an open question.
Not the decentralized and trustless ideal we went for... The Deeper Problem
Poisoning a handful of RPC nodes and DDoS'ing a few others was enough to fabricate $292 million out of thin air and erodes trust across the entire DeFi ecosystem. No smart contract exploit. No zero-day. Just a misconfigured verifier and an infrastructure-level attack on the nodes it relied on.
But the root cause runs deeper than Kelp's configuration. The fundamental problem is the trust model. Kelp's bridge, like most bridges and many Layer 2 rollups, relies on oracles reading blockchain state from RPC nodes and attesting that "this thing happened." The security of the entire system reduces to one question: can you trust the nodes feeding data to your verifier?
The Kelp hack proves the answer is no. Not the decentralized and trustless ideal we went for...
There is a fundamentally different approach: validity proofs. Instead of trusting oracles to honestly report what happened on another chain, you require a cryptographic proof, a zero-knowledge proof, that the state transition actually occurred according to the protocol's rules. The verifier on the destination chain doesn't trust any RPC node, any oracle, or any DVN. It checks the math. Either the proof is valid or it isn't.
This is exactly the model ZK rollups use to settle on Ethereum. The L1 doesn't ask an oracle "did these transactions happen?" It verifies a succinct proof that they did.
▶ The Goose That Lays the Golden Eggs
One could argue the attacker showed restraint. With a 1-of-1 DVN, they could have minted any amount, $292 BILLION, if they wanted. There are liquidity arguments (you can only extract what lending markets will let you borrow against) and detection arguments (the larger the mint, the faster the response). But there's a more cynical reading.
The Lazarus Group and similar state-sponsored actors are in a peculiar position. They could mint an amount large enough to collapse the entire DeFi ecosystem. But doing so would kill the very system they profit from. So they calibrate, enough to fund their operations, not so much that the ecosystem loses confidence and collapses. The goose must keep laying.
The DeFi ecosystem likes to talk about trustlessness and decentralization. But when a handful of poisoned RPC servers can drain nine figures and trigger a systemic crisis, we should be honest about where we actually are, and serious about the cryptographic tools that can actually get us there.
Stay safe.
TL:DR:
* LayerZero says it was Kelp's fault for running 1/1 DVN setup, their docs warn against that (although LZ operated the actual DVN)
* Yep, North Korea again
* LayerZero had solid opsec but still got pwned (they're not disclosing the original compromise path it seems)
* Crazy sophisticated attack. North Korea didn't actually fully compromise the LZ machine. But once they got in, they grabbed the set of RPCs the LZ machine used, and then hacked 2 of the RPC servers it was pulling from, installing fake versions of op-geth on those RPC servers. They then DDOSed the main RPC to cause failover to one of the hacked RPCs, and then the hacked RPCs reported the malicious transaction (hiding their tracks by giving different RPC responses to observability infra). Then once the attack was done, the malicious binary self-destructed, deleting the logs on the compromised RPCs. Very, very complex attack.
* Boy, LZ really are not doing themselves favors with lines like these:
"We want to be unambiguous on this point: the LayerZero protocol itself functioned exactly as intended throughout this event. [...] The entire attack was isolated to a single application – zero contagion risk throughout the system, zero other OFTs or OApps impacted."
😬
Was at an Institution Side Event at PBW
Talked to 10ppl
7 of them hedge fund / fund with digital assets
AUM $5M-500M
Only 1 of them uses DeFi
Definitely a different crowd