It's been a black Wednesday for Solana DeFi. Drift, the blockchain's largest perpetuals protocol, suffered this year's biggest exploit, losing over $280 million in deposits.

What appears to be another successful North Korean attack was likely not a hack in the classical sense. The attacker neither stole private keys nor exploited vulnerabilities in the smart contracts.

Instead, they managed to trick at least two of five Security Council members into pre-signing powerful admin transactions, allowing them to pledge worthless tokens as collateral and borrow massive amounts of real assets (USDC, SOL, wrapped BTC, etc.) from Drift's vaults and pools.

The exact method remains unclear, but the damage is done. Drift's TVL plunged 50%, from $550 million to $225 million, likely only not falling further because deposits and withdrawals remain suspended.

It's a setback for a Solana DeFi ecosystem that was just beginning to attract institutional interest, much of which has historically gravitated toward the more battle-tested protocols on Ethereum.

But the challenge extends beyond Solana. For DeFi broadly, it's another painful reminder that operational security has to be held to a higher standard than in traditional finance. When assets move instantly and irreversibly, the margin for human error is essentially zero. Speed is DeFi's selling point. It's also its biggest vulnerability.

Boots on the ground: This week, our team was on the ground at three major events during this year’s EthCC in Cannes. While part of the team attended Kaiko’s inaugural The Agora event (see our recap in yesterday’s Institutional Briefing), others spent two days at the RWA Summit at the iconic Palm Beach and the Vault Summit, hosted by lending protocol Morpho at the Hôtel Majestic Barrière.

Onchain vaults take center stage: The defining theme across both events was the rise of onchain vaults: smart contracts that pool capital from depositors and deploy it according to a strategy set by a curator, an entity that decides which assets to lend against, sets risk parameters, and manages the allocation.

Catalysts: Two forces are driving this growth. First, the rapid expansion of stablecoin supply and the onchain economy it enables. Second, a broader strategic imperative to future-proof existing asset management business models.

Unlocking new opportunities: Moy also explained how onchain infrastructure can open up entirely new lending categories, sharing the example of credit card receivables: today, Apollo structures these as multi-billion dollar deals with a single counterparty over multi-year terms, because the operational cost only makes sense at that scale. Onchain, smart contracts can aggregate many smaller borrowers into one facility.

A lot of open questions: Before this transformation can scale, however, key questions around onchain vaults remain unresolved, most of which were directly addressed at both events.

Proper risk management: A recurring theme across panels was the need for robust risk management by vault curators, brought into sharper focus by last week’s $25 million exploit of DeFi protocol Resolv, which resulted in losses for several curators.

Regulatory gray zone: Some panelists linked these shortcomings to the absence of clear regulatory standards and oversight. Tuongvy Le, former SEC lawyer and General Counsel at vault infrastructure provider Veda, reiterated the need for defined rules to ensure investor protection:

Not covered by MiCA: A similar challenge exists in the EU. As Stéphane Daniel, partner at French law firm d&a partners, noted in his keynote, the curator role did not exist when MiCA was drafted. As a result, curators operate in a regulatory gray zone, where activities such as selecting collateral or setting risk parameters could be interpreted as regulated services like portfolio management or advisory.

Missing infrastructure pieces: Regulation is not the only gap. On the infrastructure side, speakers highlighted three concrete challenges:

Bringing more assets onchain: As long as these gaps persist, the investible onchain asset base remains limited, which in turn reduces the incentive for institutions to build meaningful onchain operations.

Short-duration assets: One possible path forward is to bring assets onchain that better align with DeFi’s structural requirements. Rather than long-duration private credit, whose liquidity profile clashes with instant redemption expectations, some panelists highlighted shorter-duration instruments such as invoice receivables as a more natural fit.

A word of caution: Not everyone shared the optimism around bringing more real-world assets onchain. Mehdi Lebbar, co-founder of Yo Labs, warned that some of the private credit entering DeFi vaults may represent adverse selection: assets that failed to find buyers through traditional channels:

Our takeaway: Despite the clear focus on current challenges, the mood at both events was one of excitement. It reminded us of the early DeFi days in 2020 and 2021, with one stark difference: the conversations were grounded in reality, with almost everyone acknowledging the gap between ambition and operational readiness.