Kraken routes BTC into Aave as DeFi’s $1.1bn hack year bites
Kraken's Bitcoin Vault routes BTC into Aave and Morpho for yield - the same week OpenZeppelin's co-founder called DeFi unsafe amid $1.1bn of hacks in a year.
Kraken began routing customers’ Bitcoin (BTC) into Aave and Morpho for yield on May 27, 2026 — the same day one of DeFi’s best-known security figures told people to get out of those exact protocols. The split-screen captures the central tension in institutional crypto: capital is professionalising its on-chain yield strategies just as the security narrative deteriorates, with more than $1.1 billion lost to decentralised-finance (DeFi) hacks over the trailing 365 days (CoinDesk, May 27, 2026).
The warning came from Manuel Aráoz, co-founder and former chief technology officer (CTO) of smart-contract security firm OpenZeppelin, who said he had told friends and family to exit DeFi entirely, naming Aave, MakerDAO and Compound. His argument is structural rather than cyclical: artificial-intelligence (AI) coding agents have shifted the offence-defence balance in attackers’ favour.
“I now consider all of DeFi unsafe. Coding agents are superhuman at finding vulnerabilities, and smart contract security is too asymmetric: defenders need to fix every bug while attackers need just one exploit to steal funds.”
— Manuel Aráoz, co-founder and former CTO, OpenZeppelin (CoinDesk)
A record year of exploits sets the backdrop
The data behind the warning is hard to dismiss. Beyond the $1.1 billion headline figure, 2026 has produced a string of high-profile failures: the Kelp DAO exploit drained roughly $292 million in April 2026, and Step Finance lost $27 million in January before shutting down. The pattern continued the same week as Kraken’s launch, when an attacker compromised Stake DAO’s deployer private key and minted 5.4 trillion fake vsdCRV tokens with a nominal value near $763 billion — though thin decentralised-exchange (DEX) liquidity capped the actual theft at about $91,000. The near-miss underlined the asymmetry Aráoz described: a single key compromise can, in principle, mint unlimited supply.
Exchanges and protocols are leaning in, not retreating
The institutional response has been to engineer around the risk rather than withdraw. Kraken’s new Bitcoin Vault lets long-term holders earn up to 2.5% annual percentage yield (APY) paid in BTC by routing deposits into Aave, Morpho and Tydro, with infrastructure from Veda and risk management by Sentora — a deliberate separation of routing and risk that mirrors how traditional finance outsources execution. Kraken’s broader DeFi Earn programme has gathered more than $240 million in assets under management since January 2026. The model echoes the institutional packaging seen in BlackRock’s tokenised funds on Ethereum and the venue competition behind Hyperliquid’s pre-IPO perpetuals.
OpenZeppelin itself pushed back on its co-founder, saying Aráoz’s views “do not represent OpenZeppelin’s current position,” with leadership favouring “AI-augmented security” — using the same AI tooling defensively — over a retreat from the sector. That disagreement is the real debate institutions now have to price.
“Many bitcoin holders on Kraken have made it clear they want simple, safe ways to earn on the bitcoin they already plan to hold. Bitcoin Vault is built for that mindset.”
— John Zettler, General Manager of Payward Services and head of Kraken Earn Products (Crypto Times)
Why this matters for institutional crypto
For exchanges, custodians and fund managers, the contradiction is the story. Demand for on-chain yield is real and growing, which is why Kraken — and the names behind Morgan Stanley’s crypto push — keep building products that touch DeFi rails. But smart-contract risk is rising, not falling, and the word “safe” sits awkwardly next to a $1.1 billion annual loss rate (CoinDesk). The compromise emerging across the industry is intermediation: an exchange or a risk firm stands between the retail holder and the raw protocol, absorbing operational complexity and, implicitly, some reputational liability if a routed protocol is exploited. That is a meaningful shift from DeFi’s original disintermediation thesis.
The open question is whether that intermediated model genuinely reduces risk or merely relocates it. Routing BTC into Aave and Morpho does not make those contracts safer; it concentrates exposure at the routing layer, where a single integration bug or oracle failure could affect every depositor at once. Total value locked across DeFi, tracked by DeFiLlama, will be the clearest scoreboard: if institutional products keep growing even as headline hacks mount, the market is pricing intermediated yield as worth the tail risk.
What to watch next is whether a major exploit hits a protocol inside one of these packaged products. The first time a Kraken-, Coinbase- or BlackRock-adjacent yield route loses customer funds to a smart-contract failure, the industry will learn how much of the “safe” framing is real and how much is distribution. Until then, expect more exchanges to launch BTC- and ETH-denominated yield vaults and more risk firms to insert themselves as middleware.
This article is informational analysis only and is not financial, investment, or trading advice. Cryptocurrencies are highly volatile and can lose substantial value rapidly. Past performance and historical patterns do not guarantee future results. Do your own research and consult a regulated financial adviser before making any investment decision.
Reporting by Karthik Subramanian. Filed 29 May 2026, 17:07 GMT.
Digital Assets Correspondent
Karthik Subramanian is a founder, writer, and technology consultant with nine years in the crypto ecosystem.
