Hack after hack, it's becoming clear why TradFi built so many layers, controls, and safeguards over the years. Yes, that complexity can sometimes feel maddening - and part of DeFi’s original promise was precisely to strip it away. But it's also time to move past the myth of full decentralization. Much of DeFi today is far more centralized - and fragile - than many would like to admit. And not all complexity is useless. Far from it. After @DriftProtocol, @KelpDAO has now been hacked. This needs to be said clearly: these exploits aren’t going away. They’re structural. I’ve been covering crypto as a journalist for nine years. Before that - and alongside it - I covered banks and financial markets for years. I’ve seen how financial institutions operate, and there’s a reason why so many processes, controls, and safeguards exist. They weren’t built for fun - they were built after decades of failures, crises, and costly lessons. With very few exceptions, the way many protocols are organized remains alarmingly amateur. Basic processes are often missing, governance is fragile, and in the end, a small vulnerability is enough for someone to walk away with $300M - triggering chaos across the market. And at this point, what we’re seeing in parts of DeFi is no longer innovation - it’s negligence. Cutting corners on security, governance, or operational controls isn’t bold experimentation anymore. It’s risk transfer to users and the broader ecosystem. And that’s becoming increasingly unacceptable. Another structural issue: many DeFi teams are stacked with exceptional engineers - but very few people with deep financial or risk management experience. There’s often a belief that everything can be radically simplified through technology. But repeated failures - especially human ones - are showing the limits of that approach. This shift is also visible geographically. It’s no coincidence that crypto has increasingly moved from San Francisco to NYC. This is becoming less of a pure tech story and more of a financial infrastructure story - closer to Wall Street than Silicon Valley. We’ve seen this movie before. Only a handful of native DeFi players - both protocols and curators - will survive the ongoing wave of hacks. The protocols still standing in 2–3 years will likely be regulated. The same goes for curators, who will eventually be recognized for what they truly are: asset managers. Regulation in DeFi will inevitably bring baseline standards for security and organization. What we’re seeing on the ground today - from key management to permission structures - is often frankly frightening. More broadly, institutionalization is already underway. And institutionalization doesn’t happen without some form of regulation. Traditional players - banks, asset managers, fintechs - along with regulated crypto actors under MiCA or the Clarity Act, will increasingly launch on-chain products. They will demand standards. And those standards will shape the next phase of DeFi. Market forces are powerful for innovation and growth. But they have limits when it comes to security and systemic risk. Regulation is coming - and to some extent, it’s necessary. The real challenge will be ensuring it doesn’t become overly restrictive or anti-innovation. For that to happen, native DeFi players need to lead by example and build trust. Right now, behind the narratives and the marketing, there’s still a long road ahead.
