Jefferies analyst Andrew Moss said in a recent report that the $293 million Kelp DAO exploit on April 18 could reach well beyond DeFi. In his view, the incident is becoming a serious warning for traditional financial institutions that have been accelerating tokenized asset initiatives and now have to revisit the security assumptions behind cross-chain infrastructure.
The damage spread from Kelp DAO into lending markets
According to the report, the attacker targeted Kelp DAO’s cross-chain bridge, which relied on a single-validator design. After exploiting that structural weakness, the attacker minted large amounts of unbacked tokens and used them on lending platforms to borrow real assets. On-chain defenses were too slow to contain the fallout.
Aave was among the most direct victims. The source material says the protocol was left with more than $200 million in bad debt, while total DeFi TVL fell by nearly $9 billion in a single day as the event unfolded. On-chain investigators and multiple security firms are still comparing the attacker’s transaction patterns with methods commonly associated with North Korean hacking group Lazarus Group.
Cross-chain bridges are now under harder scrutiny
Moss argued that tokenization projects in traditional finance have been expanding at unusual speed, but the Kelp DAO exploit exposed a core dependency shared by many of them: cross-chain rails. The issue is not only a bug in one protocol. It is the fact that critical security assumptions still rest on concentrated trust.
He warned that the “ripple effects” of the exploit could temporarily slow TradFi adoption because security risks now need to be reassessed. For banks and asset managers looking to bring treasuries, fund shares, or real estate on-chain, cross-chain bridges are difficult to avoid. The systemic risk embedded in a single-validator model has now been made much more visible.
Long-term interest remains intact, but the industry needs time
Moss did not turn negative on digital assets over the longer horizon. He said improving regulation and gradual infrastructure upgrades still support institutional interest in the sector. The source also notes that stablecoin use in cross-border payments continues to expand, with no clear retreat tied to this incident.
Still, the report ends on a restrained note: the digital asset industry needs more time to mature. For large institutional capital, regulation alone is not enough. The technical base also has to hold up under stress, and this attack showed that single-validator cross-chain bridges are not there yet.