Which of these is on your radar? TSS key management, bridge exposure, governance velocity, concentrated treasury strategy.
What's the risk category your model doesn't cover yet?
What are we missing?
DeFi Development Corp holds 2.3M $SOL, running its own validators at 7.5% yield vs ~3.9% on centralized providers.
"MSTR playbook" applied to a single native asset plus self-custody staking.
Stress-testing concentrated on-chain treasury risk? This is the live case study.
Aave's $USDe supply cap on MegaETH: 200M, 400M, 800M in three days. Each expansion triggered by 99%+ cap utilization.
Risk stewards are chasing inflows.
Whether USDe is safe isn't the question. Whether governance velocity can keep up with demand is.
April 2026: ~28 exploits, $606M+ stolen. The most-hacked month in crypto history by incident count.
YTD: $770M lost, 40+ protocols in wind-down. Two incidents accounted for 76% of losses.
Bridges were the common thread. Again.
THORChain lost $10.8M on May 15. Drained across 9 chains via a GG20 TSS flaw plus a rogue node. Trading halted 13 hours.
The attack vector wasn't a smart contract. It was threshold-signature key management.
Cross-chain infrastructure runs a different threat surface.
Yield diversification breaks down exactly when you need it most.
Sources that look uncorrelated in normal conditions converge under stress. Correlation isn't a constant — it's regime-dependent.
We model this with a conservatively calibrated volatility multiplier that adjusts
The question operators are sitting with: do you know which collateral assets in your yield vaults depend on cross-chain bridges you haven't reviewed? Not rhetorical — it's a parameter that currently exists outside most treasury risk models.
In the same 30 days, Morpho's TVL grew to $11.78B — ETH-denominated supply tripled YoY. Capital doesn't file a post-mortem first. Operators are already making decisions about which dependency risk profiles they're willing to hold.
Today, Aave restored WETH LTVs across all 6 networks — 30 days post-breach. Recovery complete. But any vault in your stack that touched rsETH had indirect exposure to KelpDAO's bridge, regardless of what Aave's own audit said.
What didn't make headlines: for 4 weeks, WETH LTV ratios were frozen across 6 Aave V3 networks. No depositor loss if you held — but operational constraints that no smart contract audit could have predicted. The contagion ran through borrowing capacity, not code.
Aave's Umbrella safety module activated — its first real-world stress test. Partners coordinated recovery: $160M raised of ~$200M needed. Standard Chartered called DeFi's response "resilient." The coordination worked. But it took 30 days.
OpenZeppelin this week: "$292M lost, zero bugs found." Aave's code was clean. KelpDAO's code was clean. The exploit lived in the integration layer — cross-chain bridge dependency. The risk category institutions most consistently underweight.