$20B DeFi TVL drop and $1.1B in hacks test the narrative. This guide separates application-layer risk from stablecoin strength holding $153B in T-bills.
The decentralized finance sector absorbed two narrative shocks in the same window: a $20 billion decline in total value locked and $1.1 billion lost to exploits, including the $292 million Kelp DAO bridge hack. The immediate verdict from critics was binary – “DeFi is dead,” one commenter on X wrote. Former OpenZeppelin CTO Manuel Aráoz warned that AI is becoming “superhuman” at hacking open-source code.
Andrew Forson, president of DeFi Technologies, offers a counter-read that separates localized code failures from the infrastructure layer that now holds more U.S. Treasuries than Saudi Arabia or Germany. For traders building a watchlist, the question is whether the TVL drawdown and exploit tally represent a structural break or a stress test that the core stablecoin layer can absorb.
Total value locked across DeFi protocols fell from roughly $60 billion to $40 billion over recent months, driven by a combination of falling ETH and BTC prices and capital rotation into yield-bearing T-bill proxies outside DeFi. The $1.1 billion in exploit losses, concentrated on bridge and lending protocols, gave critics the second leg of the argument: the code is fragile and AI will make it worse.
A naive interpretation groups both facts into one verdict – DeFi is losing both users and safety. TVL declines signal demand destruction. Hacks signal fundamental design flaws. The two together create a negative feedback loop: lower TVL means less liquidity to absorb exploits, which scares away the remaining capital.
Forson draws a hard line between application-layer hacks and the core network and stablecoin infrastructure. “You haven’t heard of any core hacks to the Bitcoin or Ethereum networks,” he said. “You haven’t heard of any core hacks to Circle’s USDC or Tether’s USDT.” The $1.1 billion in losses came from smart contract bugs, not from a compromise of the settlement layer or the stablecoin issuer smart contracts.
That distinction matters because the TVL drop was largely concentrated in lending and yield protocols, not in the stablecoin base. USDT and USDC market caps have remained stable, and the supply of stablecoins deployed in DeFi has not declined proportionally. The TVL metric conflates price-driven asset value shrinkage with actual capital exit.
Stablecoins held positions in U.S. T-bills exceeding $153 billion as of December 2025, according to the Bank for International Settlements (BIS). That figure puts the stablecoin ecosystem ahead of Saudi Arabia ($135 billion) and Germany ($100 billion) in terms of Treasury holdings – a data point that undercuts the “collapse” narrative.
Forson noted that the $153 billion in T-bill backing is not hypothetical. “All of those treasuries are used to back currencies and stablecoins that are predominantly used foremost in DeFi.” The stablecoin-to-Treasury pipeline means that demand for yield-bearing digital dollars flows directly into U.S. sovereign debt, creating a structural link that institutional investors and regulators have begun to take seriously.
Blockchain intelligence firm Chainalysis estimates that stablecoins moved more than $35 trillion last year. The trajectory points to $730 trillion to over a quadrillion dollars by 2035. Even allowing for estimation error, the implied annual growth rate is far higher than comparable fintech or traditional payment rails. Forson puts core stablecoin volume expansion at 20% to 30% month-over-month.
Aráoz’s warning that AI is becoming “superhuman” at hacking open-source code plays into a well-established fear: transparency is a liability. If an AI model can read every smart contract on Ethereum and find zero-day exploits faster than any human auditor, the entire DeFi stack becomes vulnerable to automated attacks.
Forson flips the argument. Onchain transparency, he argues, is DeFi’s defense. “When something goes wrong, everybody sees it, everybody talks about it and they fix it.” He contrasts this with legacy banking, where systemic errors can remain in “private buckets” for years before an auditor notices. The 24/7 operation of DeFi means protocol gaps are exposed, stress-tested, and patched exponentially faster than any closed-door system.
Key insight: Application-layer hacks are a cost of experimentation, not an indictment of the underlying network security. Bitcoin and Ethereum have not suffered core consensus failures despite years of continuous operation. The largest single DeFi exploit, the $600 million Poly Network hack, resulted in the return of almost all funds – a sign that onchain forensic tracking works.
The AI risk is real for exotic, unaudited code, not for the base layer. Treat protocol-specific hacks as a tail risk for individual positions, not a systemic threat to the stablecoin and settlement infrastructure.
Forson warned that “if the Wall Street players don’t participate in this space now, they will lose market share, because someone else will.” The data suggests Wall Street is already moving. Morgan Stanley, BlackRock, JPMorgan, and Charles Schwab have all rolled out crypto services one way or another.
BlackRock’s BUIDL fund, JPMorgan’s Onyx network, and Morgan Stanley’s crypto custody offerings point to a tokenization pipeline that will eventually bring equities, bonds, and real estate onto blockchain rails. The $153 billion in stablecoin Treasuries is the proof of concept: if institutional capital is comfortable using USDC and USDT as a settlement layer for T-bills, the same logic applies to other assets.
Morgan Stanley (Alpha Score 58/100, label Moderate, sector Financials) and Charles Schwab (Alpha Score 44/100, label Mixed, sector Financials) both appear in institutional crypto rollouts. The MS score near the median suggests the market sees the potential waiting for execution clarity. SCHW’s lower score reflects execution risk and competition from Coinbase and Fidelity. For traders, the divergence between the two stock scores is a clue: MS is better positioned to monetize the tokenization trend.
The $20 billion TVL drop will be tested over the next two months. If ETH and BTC stabilize and TVL recovers without new large-scale exploits, the stress-test narrative will gain credibility. If TVL continues to fall while stablecoin volumes keep growing, the market will begin to treat DeFi as a two-tier system: infrastructure survives but application-layer yields do not recover.
The DeFi space is 16 years old, as Forson noted. The TVL drawdown and hack tally are real and visible. The better market read separates the noise of protocol-specific failures from the signal of infrastructure adoption. For now, the stablecoin base layer is intact and growing. The risk is that continued exploits erode user confidence faster than the T-bill narrative can rebuild it.
For deeper analysis on Bitcoin and Ethereum cross-asset dynamics, see our crypto market analysis.
Prepared with AlphaScala research tooling and grounded in primary market data: live prices, fundamentals, SEC filings, hedge-fund holdings, and insider activity. Each story is checked against AlphaScala publishing rules before release. Educational coverage, not personalized advice.