TLDR Tech / Crypto
Letter 111: I'm Pulling All My Money Out of DeFi
April was the most hacked month in crypto history by incident count, ~$651M stolen across 40+ separate exploits dominated by two Lazarus Group-linked attacks: the $285M Drift perp exchange drain (a six-month social engineering op using Solana's durable nonces to get contributors to pre-sign transactions) and the $292M KelpDAO exploit (attackers manipulated a misconfigured 1-of-1 LayerZero DVN to mint 116,500 unbacked rsETH, triggering $8.4B in Aave deposit outflows and a $13B+ DeFi TVL decline). The larger threat ahead is AI-driven smart contract exploitation: Anthropic's unreleased Claude Mythos model demonstrated it can find zero-day vulnerabilities at a scale surpassing all but the most skilled humans, and equivalent capabilities are expected in the wild within 6-18 months. The recommendation is to withdraw funds from DeFi protocols to cold storage now, as the reward-to-risk ratio of onchain yield has flipped against users in this environment.
Read the full story