The $293M KelpDAO hack signals DeFi's reckoning with complexity — not code!

The $293 million KelpDAO exploit last month has become a defining moment for decentralized finance — not because a smart contract failed, but because one didn't. The vulnerability traced back to LayerZero's bridge infrastructure, cascading outward into protocols built on top of it. As Lido Labs' Eugene Mamin put it: "The contracts did exactly what their authors told them to do. The authors just weren't the legitimate people in that case."

Industry leaders are drawing a clear conclusion: smart contract risk is largely a solved problem. "Recently, all the hacks have been from bad operational security," said Sam MacPherson, CEO of Phoenix Labs, the team behind Spark. The real attack surface now spans multisigs, SaaS providers, key management systems and software supply chains — web2 vulnerabilities wearing a DeFi mask.

The incident is accelerating a broader rotation toward what builders…