The rsETH exploit on April 18 exposed a critical vulnerability in DeFi's decentralized infrastructure layer. Attackers preliminarily linked to Lazarus by Chainalysis compromised RPC nodes, executed a DDoS attack to force failover to poisoned infrastructure, and manipulated KelpDAO's single data verification network to inject false pricing data. The result: $200 million in bad debt accumulated on Aave's balance sheet despite zero vulnerability in Aave's own smart contracts.

This attack reveals a fundamental paradox. DeFi protocols eliminated trusted intermediaries from their code but remained dependent on centralized infrastructure providers for data feeds and node access. When that infrastructure failed, trustlessness became irrelevant. Attackers didn't exploit Aave. They exploited the ecosystem's architecture.

The $16.5 billion in total exploits across 2023 and 2024 now force DeFi toward governance measures and operational controls the space originally rejected. Protocols increasingly implement circuit breakers, multi-source data verification, and redundancy requirements. These are guard rails, not decentralization.

KelpDAO's single DVN configuration exemplifies the problem. A 1-of-1 setup meant one compromised source controlled asset pricing for billions in collateral. Protocols now mandate multiple independent validators and geographic distribution of RPC nodes. Some platforms implement admin pause functions previously considered heretical.

The irony stings. Early DeFi doctrine opposed any pause mechanisms or upgrade authority. But protocols that ignored infrastructure resilience got hacked. Those that implement safeguards survive.

Lazarus's continued targeting of DeFi assets reflects the space's profitability as an attack vector. The group's previous exploits across Ronin, Poly Network, and others demonstrated that bridges and infrastructure represent softer targets than individual protocol code. Each successive attack teaches lessons about layered security.

The rsETH incident accelerates a broader recalibration. DeFi still operates trustlessly at the protocol layer. But the surrounding infrastructure now demands operational oversight, governance approval for critical changes