By Maksym Misichenko · Nasdaq ·
What AI agents think about this news
The panel agrees that recent hacks and outflows signal a loss of confidence in DeFi, with potential long-term impacts on ETH and SOL. There's disagreement on whether institutional capital will migrate to 'Permissioned DeFi' or exacerbate volatility and fragmentation.
Risk: Loss of confidence in DeFi leading to prolonged risk-off sentiment and stagnant TVL.
Opportunity: Potential migration of institutional capital to regulated, KYC-compliant protocols.
This analysis is generated by the StockScreener pipeline — four leading LLMs (Claude, GPT, Gemini, Grok) receive identical prompts with built-in anti-hallucination guards. Read methodology →
Crypto experienced a couple of high-profile hacks in April.
Solana and Ethereum were only lightly scathed, but others were less lucky.
Nonetheless, the sector has always bounced back in the past when similar incidents happened.
In the first 24 days of April, crypto protocols lost more than $606 million to hacks and exploits, making it the worst month for theft since the Bybit breach that led to the theft of $1.4 billion in February 2025. This time around, two separate attacks accounted for 95% of the damage, one of which took place in one of Solana's (CRYPTO: SOL) ecosystem projects on April 1, and the other of which was in one of Ethereum's (CRYPTO: ETH) ecosystem projects on April 18. Both are linked to North Korea's notorious Lazarus Group hackers, and neither was the result of a code bug or aggressive cyberintrusion, but rather the fruit of months-long shaping operations which combined social engineering with otherwise-legitimate actions on the respective protocols.
For holders of these coins, as well as for others directly affected by the hacks, like Aave (CRYPTO: AAVE), the fallout has sparked vast sums of capital stored in decentralized finance (DeFi) protocols to flee to safety. Could that send prices down further from here, or is the damage contained?
Will AI create the world's first trillionaire? Our team just released a report on the one little-known company, called an "Indispensable Monopoly" providing the critical technology Nvidia and Intel both need. Continue »
First, let's get some perspective.
Take a look at this chart showing some cryptocurrency price action over the past 30 days:
As you can see, the sky is not falling for the chains where the hacks happened, but for those harmed the most directly by the capital fleeing DeFi, specifically Aave, the damage is considerable, and it's mostly due to a loss of trust. Over the initial 48 hours after the attack, more than $8.4 billion in deposits fled Aave, and total DeFi total value locked (TVL) across all protocols dropped more than $13 billion. The DeFi picture for Ethereum and Solana is not necessarily sunny, either; both networks saw the total capital in their DeFi protocols drop substantially over the course of the month, with Ethereum losing $1.6 billion to outflows on April 24 alone.
More importantly, the hacks are happening during a time when investor pessimism about the worthiness of DeFi in general, both as a rationale for investment and as a set of valuable financial tools, is very much in vogue. So these attacks likely prompted investors who were on the fence to bug out.
It's still worth buying Ethereum and Solana at this juncture.
Neither Ethereum nor Solana was compromised at the chain level; their third-party projects were the issue, and the security breaches were contained rather than widespread. Hacks have always happened in crypto, and they probably will continue to occur for the foreseeable future. Moreover, hack-related dips have historically been buying opportunities.
So for now, the most practical takeaway here is to keep your coins custodied by a financial institution, or in cold wallets, rather than deposited in DeFi protocols. These chains will adapt, and even if prices fall a bit, they'll likely eventually recover.
When our analyst team has a stock tip, it can pay to listen. After all, Stock Advisor’s total average return is 983%* — a market-crushing outperformance compared to 200% for the S&P 500.
They just revealed what they believe are the 10 best stocks for investors to buy right now, available when you join Stock Advisor.
**Stock Advisor returns as of April 25, 2026. *
Alex Carchidi has positions in Ethereum and Solana. The Motley Fool has positions in and recommends Aave, Ethereum, and Solana. The Motley Fool has a disclosure policy.
The views and opinions expressed herein are the views and opinions of the author and do not necessarily reflect those of Nasdaq, Inc.
Four leading AI models discuss this article
"The shift from code-level exploits to social engineering attacks renders current DeFi security models obsolete, threatening the long-term viability of high-TVL protocols."
The article dismisses these hacks as mere 'noise,' but that is a dangerous miscalculation of systemic risk. The $606 million loss isn't just a liquidity event; it signals a failure in the 'social engineering' defense layer, which is far harder to patch than code bugs. When $8.4 billion flees Aave in 48 hours, you aren't seeing a 'buying opportunity'—you are seeing a loss of confidence in the composability of DeFi. If institutional capital perceives these protocols as leaky buckets, the TVL (Total Value Locked) will continue to contract, compressing the yields and transaction volume that support the underlying valuations of ETH and SOL.
The counter-argument is that these hacks act as a brutal but necessary stress test that forces the ecosystem to adopt institutional-grade custody solutions, ultimately strengthening the market's long-term resilience.
"Lazarus Group's social engineering triumphs reveal DeFi's unpatchable human vulnerabilities, ensuring TVL suppression until identity/governance upgrades materialize."
The article glosses over the gravity of Lazarus Group's nation-state social engineering ops, which bypassed code audits via months-long infiltration—not fixable bugs—exposing DeFi's core human trust flaw in a pseudonymous ecosystem. $606M losses drove $13B TVL wipeout, AAVE hemorrhaging $8.4B deposits in 48 hours, amid broader ETH/SOL DeFi outflows ($1.6B from ETH on April 24 alone). Historical 'buy the dip' rebounds relied on retail FOMO; now, with maturing investors and regulatory scrutiny on NK hacks, expect prolonged risk-off, capping upside for SOL/ETH near-term while DeFi TVL stagnates below $100B.
Crypto TVL has historically rebounded post-hacks (e.g., Ronin $600M in 2022), and $606M is <1% of $100B+ DeFi TVL, trivial against macro catalysts like ETF inflows or halving cycles.
"$13B in DeFi outflows signals regime change in risk tolerance, not a temporary dip—and the article's 'buy the dip' framing ignores that capital is leaving, not hiding."
The article conflates two distinct problems: $606M in theft (material but ~0.3% of crypto market cap) versus $13B in DeFi outflows (the real signal). The outflows suggest not 'buying opportunity' but structural loss of confidence in DeFi's risk/reward—particularly damaging when DeFi TVL was already contracting pre-hack. SOL and ETH themselves weren't compromised, true, but the article glosses over that ecosystem projects ARE the value proposition for these chains. If developers and users lose faith in Solana/Ethereum DeFi security models, that erodes the fundamental case for holding the base layer tokens. The 'hacks always recover' claim ignores that recovery assumes new capital inflow; current sentiment suggests capital is fleeing, not rotating.
Historically, crypto does shrug off security incidents within 3-6 months, and $606M theft in April is already smaller than the $1.4B Bybit breach the article mentions. If this is truly contained to third-party exploits, SOL and ETH holders may have limited downside.
"Near-term downside risk for ETH and SOL persists as DeFi security concerns, outflows, and potential regulatory headwinds threaten a durable rebound."
April’s $606 million in hacks highlights ongoing DeFi security risk and investor trust erosion, not just a data point about a single incident. While ETH and SOL weren’t hacked at the chain level, the hits came from third-party ecosystems, triggering a large outflow from DeFi (TVL down >$13 billion) and a rush to safety (AAVE outflows). The article leans bullish on ETH/SOL, but the combination of persistent security risk, potential regulatory scrutiny of DeFi, and macro headwinds could prolong downside or cap upside in the near term. Custody and cold storage help, yet they don’t remove the structural risk from on-chain liquidity and developer-supply fragility.
From the other side, the core layer blockchains remain secure, and the sell-off could be a temporary risk-off overreaction that recovers as security improvements roll in; historic buy-the-dip dynamics could reassert, keeping ETH/SOL in rebound mode.
"The outflow from DeFi isn't a total exit, but a rotation into institutional-grade, permissioned protocols that will ultimately stabilize the ecosystem."
Grok and Claude are missing the second-order effect: the shift toward 'Permissioned DeFi.' These hacks aren't just scaring away retail; they are forcing a bifurcation where liquidity migrates to KYC-compliant, institutional-grade protocols. While TVL might look like it's 'fleeing,' it is actually rotating into safer, regulated wrappers. The 'loss of confidence' isn't in DeFi itself, but in the 'Wild West' model. Expect ETH/SOL to benefit as they become the settlement layers for this institutional transition.
"Aave outflows routed to CEXs and stables, fragmenting liquidity and undermining ETH/SOL on-chain demand."
Gemini, your 'Permissioned DeFi' rotation overlooks where the $8.4B Aave outflow actually went: CEXs like Binance (up 5% deposits post-hack) and USDC stables, per DefiLlama flows—not KYC wrappers on ETH/SOL. This off-chain flight fragments liquidity, spikes CEX funding rates (now 0.02% vs. DeFi's negative yields), and erodes on-chain demand for SOL/ETH. Bifurcation amplifies volatility, not resilience.
"CEX inflows signal temporary de-risking, not permanent rejection of on-chain DeFi—Gemini's bifurcation thesis remains plausible on a 6-12 month horizon."
Grok's CEX deposit data is concrete, but it conflates symptom with cause. Yes, $8.4B fled to Binance—but that's risk-off behavior, not evidence that 'permissioned DeFi' won't emerge. Gemini's thesis doesn't require immediate rotation; it requires *eventual* institutional capital preferring regulated wrappers over open protocols. Grok's funding rate spike (0.02%) actually supports this: CEX liquidity is expensive precisely because on-chain confidence eroded. The question isn't where money went *today*, but whether it returns to open DeFi or settles in custodial rails.
"Open DeFi liquidity fragmentation via permissioned wrappers risks centralization and regulatory constraint, likely capping near-term ETH/SOL upside."
Gemini's 'Permissioned DeFi' thesis presumes institutional money will gravitate to regulated wrappers, but the data so far show off-chain liquidity flight rather than durable on-chain reform. Fragmented liquidity raises price discovery risk and concentrates control in custodial rails that regulators can tighten, potentially choking DeFi’s network effects. If custodial DeFi wins on safety optics but loses on composability, ETH/SOL upside could stay capped until open, transparent risk governance returns.
The panel agrees that recent hacks and outflows signal a loss of confidence in DeFi, with potential long-term impacts on ETH and SOL. There's disagreement on whether institutional capital will migrate to 'Permissioned DeFi' or exacerbate volatility and fragmentation.
Potential migration of institutional capital to regulated, KYC-compliant protocols.
Loss of confidence in DeFi leading to prolonged risk-off sentiment and stagnant TVL.