Michael Egorov, founder of Curve Finance, publicly raised concerns about structural vulnerabilities in the DeFi industry on April 21, 2026, stating that “preventable hacks” stemming from centralized single points of failure are damaging industry trust and cannot be ignored any longer.
On April 18, Kelp DAO’s cross-chain bridge vulnerability was exploited, resulting in the theft of approximately 116,500 rsETH (restaked Ethereum), valued at approximately $292 million. LayerZero handled the cross-chain movement in this incident. Following the attack, major DeFi lending protocols including Aave froze the rsETH market and restricted related deposits and borrowing.
Egorov criticized the interconnected nature of multiple infrastructure components—Aave, rsETH, and LayerZero—and the resulting structure that diffuses accountability. He noted that “despite users being unable to withdraw their assets, each project claims to be operating normally,” emphasizing that “ultimately, only users bear the losses.”
Egorov argued that addressing these issues requires prevention rather than post-incident response. He advocated for:
Egorov called for collaborative action across the DeFi sector to establish safety standards applicable to the entire industry. He proposed that projects, auditors, and risk assessment groups work together to establish safe design principles and verification criteria.
He further suggested that major ecosystem institutions—specifically the Ethereum Foundation and Solana Foundation—should take the lead in establishing industry standards. Egorov also referenced the need to learn from traditional finance’s risk management approaches.
While expressing confidence that “DeFi will ultimately prevail,” Egorov warned that failure to address current structural vulnerabilities could result in serious erosion of trust during the path to mainstream adoption.