DeFi Summer during that period, what everyone played with in the farms was five-figure annualized returns. Every day chasing new pools, watching the APY fall from 50,000% to 5,000%, then to 500%, and nobody asked what a “reasonable interest rate” was. Because the premise of the whole game was to use a few days of wild, outsized gains to get back the principal, and then withdraw.
Six years later, Aave’s USDC deposit interest rate has been steady in the 5% to 6% range—looking like DeFi has finally matured. But in the past 12 months, hackers stole more than $1.62 billion from DeFi protocols. Put these two numbers side by side and you’ll find an awkward reality: DeFi is too slow for young people, and too dangerous for old money. In the middle are a group of depositors earning BB-grade yields while taking CCC-grade risks.
Over the past year, hackers stole $1.62 billion from DeFi
On April 1, Drift Protocol in the Solana ecosystem lost $285 million after a North Korean hacker’s social-engineering attacks dating back to 2025 led to the exposure of an administrator’s private key. On April 18, KelpDAO’s LayerZero cross-chain bridge was attacked: $292 million worth of rsETH was stolen, and the stolen tokens were immediately staked and borrowed as USDC on Aave V3, leaving about $196 million in bad debt. In three days, Aave TVL evaporated from $26.4 billion to $17.9 billion.
Within three weeks, the two incidents together caused $577 million in permanent losses. And DeFi Llama shows that over the past year, more than $1.62 billion has been stolen from DeFi.
Aave’s USDC market had utilization rates of 99.87% for four straight days, pushing the borrowing interest rate above 12.4%. Circle’s Chief Economist Gordon Liao personally proposed increasing the borrowing limit by four times to be able to absorb queued withdrawal demand. For any depositor who was placing USDC in the 4% to 6% yield range a month ago, a problem may arise: weren’t those yields never the right numbers?
Varys Capital’s Tom Dunleavy: The reasonable yield should be 12.55%
Tom Dunleavy, head of venture capital at Varys Capital and a former senior analyst at Messari, directly applied traditional credit-market bond math in his latest research to recalculate the reasonable yield on DeFi stablecoin deposits. His conclusion is: on Ethereum mainnet, the fair yield for providing USDC to Aave or Compound should be 12.55%. His breakdown logic is as follows:
Step one: start with the 10-year U.S. Treasury yield of 4.30%.
Step two: account for technical expected loss. Based on Chainalysis data, DeFi losses as a ratio of TVL were 0.67% in 2024 and 0.50% in 2025. But in 2Q 2026 alone, a $577 million loss appeared in a single quarter, and the annualized potential loss rate jumped to 2.0% to 2.5%. Dunleavy sets the forward-looking probability of default (PD) at 1.5% to 2.0%, and the loss given default (LGD) at 90% (DeFi exploit attacks’ historical recovery rate is only 5% to 15%), yielding an expected loss of 1.5%.
Step three: the three categories of default risk premia unique to DeFi. These don’t exist in traditional credit markets: smart contract vulnerabilities are minute-level default events, oracle manipulation and governance attacks, and composability cascade collapses. Each requires a risk premium of 0.75%, 1.00%, and 1.25%, respectively. The KelpDAO incident is a典型 case of the composability cascade: the attacker doesn’t need to break Aave; they break rsETH, and Aave’s depositors take the bad debt.
Step four: stack other premia.
Risk component | Premium | 10-year U.S. bond benchmark | 4.30% | Technical expected loss (PD × LGD) | 1.50%
Oracle manipulation risk | 0.75% | Governance / administrator private-key risk | 1.00% | Composability cascade risk (Kelp-type) | 1.25%
Regulatory asymmetry | 1.25% | Stablecoin depeg tail risk | 0.50% | Liquidity premium | 0.50% | Risk premium (model uncertainty) | 1.50%
After calculation, the reasonable yield should be 12.55%. By contrast, Aave’s USDC rate before the Kelp event was about 5.5%, sitting between investment-grade bonds and single-B high-yield bonds. It prices BB-grade credit risk, yet bears technical and composability risks that are worse than CCC-grade. Morpho’s treasury products selected by strategy managers are about 10.4%, which is closer to the reasonable range.
DeFi under 18% isn’t worth touching
In an X post on April 9, heavyweight investor Santiago Santos gave a more aggressive number than Dunleavy: at least 18% is worth it. His argument complements Dunleavy’s. “During the DeFi farming peak, people would think about APY by asking ‘how many days it takes to get the yield back as principal.’ That kind of risk perception should be re-applied to on-chain interactions today.”
Santiago’s breakdown is relatively straightforward: smart contract risk plus your own OpSec risk, plus the OpSec risk of every protocol you interact with. “The more protocols you interact with, the risk scales exponentially.” He especially pointed out that even Anthropic’s latest models have found vulnerabilities in code from the world’s most resource-rich and mature companies; DeFi protocols are written faster and audited lighter, not harder to break.
He said: “On-chain interest rates are low because there’s no demand for the assets. That’s a different issue from risk being priced correctly.” There are two solutions: demand higher on-chain yields, and the industry urgently needs better sales-point insurance products.
Morpho founder Paul Frambot: Institutions won’t leave, but they want control back
From an institutional perspective, Morpho founder Paul Frambot spent the past week visiting large institutions intensely, trying to gauge their attitude after this wave of events. He drew two clear conclusions: institutional interest won’t disappear.
The reason is simple: distribution channels won’t disappear. Massive AUM, payments, and lending are all moving on-chain, and every fintech company wants to migrate fully to the chain. “As an institution, you don’t really have a choice.” But institutions have completely lost trust in the fund pool / hub model.
What institutions and distributors want is control: control over code, control over risk, control over compliance—and the flexibility to isolate whatever they want to isolate, while also connecting to the global liquidity network. Frambot’s observations confirm the arguments made by Dunleavy and Santos: the issue isn’t DeFi’s long-term vision, but that shared-pool models like the current Aave and Compound are no longer acceptable to institutions.
The reason a “strategy-isolated treasury” like Morpho can offer yields of 9% to 12%, close to the reasonable range, is precisely that it hands risk and the administrator’s options back to the liquidity providers. Between “too slow” and “too dangerous”: where DeFi’s middle ground is—the line from the opening. Five-figure annualized returns like DeFi Summer won’t come back today. That’s a distorted price under liquidity-mining subsidies, not a real yield.
But the other side of Aave’s 5.5% doesn’t hold up either: for the generation that’s been yield farming since age 18, this rate doesn’t have enough pull to keep them on-chain; for family offices and institutions managing billions of dollars who need every position to go through thorough compliance review, the record of $577 million evaporating within three weeks is far beyond the tail risk they can tolerate.
DeFi isn’t uninvestable—it’s severely mispriced at the top of the books. 12.55% is the lower bound of a fair yield; 18% is the entry threshold for retail investors’ mental models; and an isolated-treasury architecture is the minimum condition for institutions to enter. Where these three lines intersect is the true middle ground where DeFi can simultaneously accommodate both young people and old money.
This article When DeFi is too slow for young people and too dangerous for old money: Are we all using government bond interest to carry junk bond risk? First appeared on 鏈新聞 ABMedia.
