Morpho CEO Paul Frambot tells Unchained institutions see DeFi underwriting as “not serious” after KelpDAO, but remain convinced onchain tech is inevitable.

The $293 million KelpDAO exploit has delayed but not derailed traditional finance institutions’ onchain plans, according to Paul Frambot, co-founder and CEO of Morpho, a DeFi lending infrastructure protocol.

“Most players have been set back three to six months on their onchain deployment plans,” Frambot told Unchained in a podcast on Monday. “More conservative institutions may be delayed by years.”

Delayed, but Not Deterred

Frambot said institutions recognize that fintechs are migrating onchain, creating pressure to follow or risk losing assets under management. 

Rather than retreating, some see an opportunity to become their own on-chain asset managers, he added, pointing to what they view as weak underwriting by incumbent DeFi protocols. “The current players aren’t doing a good job,” Frambot said. “There’s a market opening.”

For now, the incident is reshaping what onchain strategies look like in practice. Frambot said fintech partners are narrowing their exposure, with some pivoting to single, isolated lending markets backed by Bitcoin rather than broader, more complex configurations. “They’re going to be much more careful about growth and just restaking in general,” he said.

Rehypothecation in DeFi by Hack?

The April 18 exploit, suspected to be the work of North Korea’s Lazarus Group, targeted KelpDAO’s cross-chain bridge through a spoofed message. The attackers released 116,500 rsETH tokens, a liquid restaking token, with no underlying backing and deposited the unbacked tokens into Aave, a lending protocol, as collateral to borrow real assets. 

That resulted in roughly $200 million in bad debt on Aave and emergency freezes across multiple DeFi lending platforms. Total value locked across DeFi fell by over $16 billion in the aftermath to $83 billion Tuesday, according to DefiLlama, with Aave alone seeing over $6 billion outflow and TVL dropping by 46% to $14 billion.

Jim Ferraioli, Director of Digital Currencies Research and Strategy at the Schwab Center for Financial Research, told Unchained that the incident illustrates a core DeFi vulnerability. 

“A recent hack highlights one of the risks of DeFi—rehypothecation of the same underlying collateral,” Ferraioli said. “The unbacked rsETH was then deposited into the Aave lending protocol, where the attackers borrowed real wrapped ether (WETH), leaving Aave with significant bad debt. As a result, emergency freezes were triggered across Aave and several other Ethereum-based lending protocols to contain contagion risk.”