Since 2026, the on-chain financial ecosystem has undergone a profound transformation. After reaching a peak of roughly $164 billion in October 2025, total value locked (TVL) in decentralized finance has fallen to about $82 billion, nearly halving. Meanwhile, the tokenized treasury market broke through $15.35 billion in May 2026, with the overall market capitalization of real-world assets (RWA) climbing to around $30.9 billion—an annual increase of more than 200%. As one segment declines and another rises, on-chain capital is redefining its allocation—and the forces driving this shift go far beyond mere price cycles.
Is the Halving Simply a Mechanical Reflection of Price Volatility?
Market sentiment often equates a drop in TVL with capital exiting the ecosystem, but this assumption needs to be corrected by data. TVL is primarily calculated based on the market value of underlying assets like ETH. When the ETH price falls from nearly $4,800 to around $1,600, DeFi’s total locked value shrinks mechanically due to valuation changes—even if no users actively withdraw funds.
However, price fluctuations don’t tell the whole story. As of May 20, 2026, Ethereum DeFi TVL had dropped from $106.687 billion on January 15 to about $63 billion, a nearly 41% decrease in just four months. Ethereum’s share of DeFi TVL also fell from 63.5% at the start of 2025 to roughly 54%. This indicates that, beyond price factors, deeper forces are driving a structural migration of capital.
How a Single Attack Shattered On-Chain Capital’s Trust
On April 18, 2026, the cross-chain bridge of the liquid restaking protocol KelpDAO was attacked, with approximately $292 million stolen—making it one of the largest DeFi security incidents so far in 2026. The attack wasn’t due to a smart contract bug, but rather because KelpDAO’s rsETH LayerZero OFT bridge was configured with an insecure 1-of-1 DVN (Decentralized Verifier Network), reducing cross-chain message verification to a single point of failure.
The attacker compromised RPC nodes and launched a DDoS attack, forcing the system to fail over to controlled nodes. They then forged a cross-chain message, minting 116,500 rsETH out of thin air on Ethereum mainnet—worth about $292 million. More importantly, according to Dune Analytics, around 47% of LayerZero-powered omnichain applications still use the same 1-of-1 vulnerable configuration, exposing assets worth more than $4.5 billion. This means the KelpDAO incident wasn’t an isolated accident, but revealed a widespread systemic risk.
How Cross-Chain Vulnerabilities Cascaded Through Lending Protocols
The risk from the KelpDAO attack didn’t stop at the bridge. The attacker used forged rsETH as collateral on Aave to leverage borrowings, resulting in about $200 million in bad debt for Aave and causing 100% utilization freezes in major markets like WETH for five days. Aave’s governance forum released two bad debt scenario reports: under a uniform loss-sharing plan, the protocol faces roughly $123.7 million in bad debt; if losses are borne solely by L2 rsETH holders, the figure rises to $230.1 million. After the event, Delphi Digital noted that Aave’s point-to-pool model exposed structural weaknesses in such attacks—even if reserve ratios are eliminated, Aave’s three main markets (WETH, USDT, USDC) still incur about $52 million in annual ineffective losses.
Why Security Incidents Triggered a Shake-Up in Cross-Chain Infrastructure
Following the attack, trust in cross-chain infrastructure shifted dramatically. LayerZero admitted that allowing its official verifier network to operate with a 1/1 configuration for high-value transactions was a grave mistake, and announced it would stop supporting single-verifier message signing. Funds began migrating en masse: KelpDAO, Solv Protocol, Re, Tydro, and Lombard all announced moves from LayerZero to Chainlink CCIP. Lombard transferred over $1 billion in Bitcoin-backed assets directly; combined TVL for these five protocols now exceeds $3.4 billion, and with institutional asset wrappers, the total migration is around $4 billion. This migration wave signals a fundamental shift in how the market evaluates cross-chain infrastructure—redundancy in security configurations and diversity in verifier networks have become core criteria for protocol selection.
Why the Tokenized Treasury Market Is Bucking the Trend
While DeFi funds are accelerating their outflow, the tokenized treasury market has charted a distinctly upward trajectory. On May 13, 2026, the total value locked in tokenized US Treasuries reached $15.35 billion, surpassing the previous record of $15.1 billion in mid-April. The main driver behind this growth is a shift in macro policy. In April, US CPI rose 3.8% year-over-year, up from 3.3% in March, sharply raising expectations for Fed rate hikes. As of May 2026, the Fed’s benchmark rate remains in the 3.50%–3.75% range, and 10-year US Treasury yields fluctuate between 4.25% and 4.32%.
Tokenized Treasuries offer average annual yields of about 3.36%–3.41%, while Aave V3’s USDC deposit rate has dropped to around 2.7%. When low-risk on-chain assets start yielding more than some DeFi lending protocols, capital naturally flows toward more predictable returns.
What Drives Capital from DeFi to RWA?
The migration of capital between DeFi and RWA isn’t a simple zero-sum game—it reflects a systematic shift in investor risk appetite and return expectations. DeFi’s accelerating outflows are rooted in a combination of technical and financial risks. In the week following the Drift Protocol and KelpDAO attacks, protocols like Sky Protocol, Spark, Morpho, and EtherFi all saw TVL drop by about 10%, in line with Aave. Ethereum DeFi TVL lost 10.5% in a week, and Aave’s outflows are nearing $10 billion.
RWA offers a different allocation option—it doesn’t rely on cyclical pricing and interlocking DeFi protocols, but introduces real asset value with external sources of yield. The tokenized treasury market grew from about $3.9 billion at the start of 2025 to $15.35 billion now in just 16 months, reflecting not only accelerated institutional entry but also the establishment of a low-risk yield layer independent from the DeFi cycle.
How the Macro Rate Environment Indirectly Shapes On-Chain Capital Flows
DeFi lending rates are determined by pool utilization and aren’t directly linked to Fed policy rates, but the two are closely connected through investor asset allocation decisions. When risk-free yields (i.e., US Treasury yields) stay above 4%, DeFi protocols must offer significant risk premiums to retain capital. However, DeFi also faces another cost—the potential losses implied by security incidents. The roughly $200 million in bad debt at Aave following the KelpDAO incident is essentially a realized risk premium. When latent risks turn into actual losses, the market’s risk pricing for DeFi naturally adjusts. RWA assets, while offering limited yields, anchor their returns to real-world economic output and are backed by traditional financial collateral, making them inherently attractive to risk-averse capital in the current macro environment.
Conclusion
On-chain capital hasn’t exited the crypto ecosystem. Stablecoin market capitalization has surpassed $320 billion and continues to grow, alongside RWA expansion. This data clearly shows that capital remains on-chain—it’s simply changing its allocation. The market’s central question is no longer "Is capital present?" but "Where should capital be allocated?" DeFi’s path forward lies in restoring trust through robust security architecture and building sustainable yield models; RWA must prove its liquidity and scalability can meet institutional demand.
From the KelpDAO attack to the rise of tokenized Treasuries, a clearer picture is emerging: on-chain capital is shifting from speculative high-yield pursuits toward systematic pricing of security and yield certainty. This process itself marks the crypto financial market’s move toward maturity.
FAQ
Q1: What are the main reasons DeFi TVL fell from $164 billion to $82 billion?
Three key factors contributed: First, sharp price corrections in underlying assets like ETH mechanically reduced TVL’s dollar valuation; second, security incidents such as KelpDAO triggered a crisis of trust and accelerated capital outflows; third, tokenized Treasuries and other RWA products offered more predictable, low-risk returns, diverting some funds.
Q2: What was the core vulnerability in the KelpDAO attack? Why was it so severe?
The main flaw was KelpDAO’s use of a 1-of-1 DVN single verifier configuration, reducing cross-chain message verification to a single point of failure. Attackers compromised RPC nodes and forged cross-chain messages to mint tokens out of thin air, resulting in losses of about $292 million. According to Dune Analytics, around 47% of LayerZero-based omnichain applications still have similar configuration risks.
Q3: What fundamentally distinguishes tokenized Treasuries from typical DeFi lending?
Tokenized Treasuries derive their yield from real US Treasury coupon payments, backed by real-world assets and offering lower risk. DeFi lending rates, by contrast, depend on pool utilization, fluctuate more, and face risks from smart contract vulnerabilities and cross-chain exploits. Currently, tokenized Treasuries yield about 3.36%–3.41% annually, already higher than deposit rates on some mainstream DeFi lending protocols.
Q4: Will the growth of the RWA market persist long term?
RWA market growth is built on the macro environment of sustained high Fed rates. Data shows the tokenized treasury market grew from about $3.9 billion at the start of 2025 to $15.35 billion in 16 months—nearly quadrupling. Deep participation by institutional giants like Circle and BlackRock, along with improving compliance frameworks, provides structural support for continued RWA expansion.
Q5: Can DeFi attract capital inflows again in the future?
DeFi’s long-term viability depends on two core variables: first, its ability to build more robust security infrastructure and risk controls; second, whether it can offer competitive risk-adjusted returns amid continued growth in alternative assets like RWA. Current trends suggest the boundaries between DeFi and RWA are blurring, and the future is likely to see integration rather than zero-sum competition.
