How Morpho Survived a $300M DeFi Hack With Only $1M Exposure

Transcript

Hi everyone. Welcome to Unchained, your no-hype resource for all things crypto. I'm your host, Laura Shin. Thanks for joining this livestream. Before we get started, a quick reminder, nothing you hear on Unchained is investment advice. This show is for informational and entertainment purposes only, and my guests and I may hold assets discussed in the show. For more disclosures, visit unchainedcrypto.com. Bitcoin changed how money works. Cetus changes how Bitcoin scales. With a trust-minimized BTC and a native stablecoin CTUSD, Cetus enables Bitcoin capital markets with lending, privacy, Bitcoin yield, and more. Get started at cetus.xyz/unchained.

EtherFi is giving Unchained listeners 15% cash back on food and ride apps, and that's on top of the 3% you get on everything else. Your bank is charging you to use your own money. I switched. Go to ether.fi/unchained to claim your discount. If you gave me $50 right now, the first thing I'm buying is a pair of espadrilles. Coinbase One member month starts with 20% off your first year of Coinbase One, plus a $50 Bitcoin bonus when you spend $100 with a new Coinbase One card and your first 30 days. It's one month of more, more rewards and prizes all month long. Coinbase One is the ultimate membership to make the most of your money, and I know because I'm a happy

Coinbase One member. It gives you zero trading fees on thousands of crypto assets, 3.5% APY on USDC, boosted staking and lending rewards, and up to 4% Bitcoin back with the Coinbase One card. If you trade crypto regularly, the basic annual membership can pay for itself. Enjoy bigger rewards, exclusive drops, and experiences that money can't buy, all with Coinbase One. Sign up now to get a 20% discount on the annual plan, and so you're locked in for the weekly rewards drops starting on May 4th. Visit coinbase.com/unchained to get 20% off the first year of your annual plan today. Offers valid until May 31st. Terms apply. Coinbase One card

is offered through Coinbase Inc. and Cardless Inc. Cards issued by First Electronic Bank. Bitcoin back rates are based on card holders' assets on Coinbase. Today's guest is Paul Frambot, co-founder and CEO at Morpho. Welcome, Paul. Hey, thanks for having me. We've had quite a series of dramatic events over the last week and a half in DeFi since North Korea's Lazarus Group drained almost $300 million worth of rETH from Kelp DAO's Layer Zero bridge. It then used that um rETH as collateral in Aave, leaving almost $200 million in bad debt.

Meanwhile, Morpho had only about $1 million worth of ETH borrowed against uh the rETH in two isolated markets. How did Morpho manage to fare nearly unscathed? Yeah, I guess you know the thing first thing to understand with with Morpho and and the main difference with like other lending protocols out there like like Aave is that Morpho does not manage assets or does not choose which collateral assets are being underwritten. Uh Morpho provides a modular stack of isolated lending markets that anyone can deploy and build their own lending products in the form of vaults for people to earn yield on, right? So, what that means is that in Morpho, you can have the safest as well as the riskiest

products. Right? But it's they they are isolated to the extent that, you know, the vault curator is is configuring them to to to be like that. So, I'll give you an example, like the the the the Coinbase uh USDC lend product uh which which is powered by Morpho vault is actually only allocating into isolated markets that are extremely safe, right? And then at the opposite, you have vaults on on Morpho, right now we have more than 1,000 vaults, right? Uh that are are have a much higher yield but are underwriting uh much riskier assets, right? And we don't pretend to be a single like, you know, pool of liquidity that is like only our technology. We provide a stack for people to build their own like in in in, you know, products to to deposit USDC

and earn uh from. And and in that case, you know, turns out that some curators had underwritten uh Kelp in vaults that were, you know, meant to be more uh riskier. Uh and in total, I think the ETH exposure on is like a a million dollar as as you pointed out. But I think it's it's important to understand it's not comparable to the exposure of Aave because we're not asset manager Aave. You want to think of the Aave DAO as like a vault curator. It's like like also some people like compare Morpho and Aave and try to, you know, put one against the other, but the reality that we're not really competing with Aave.

We're just infrastructure for asset managers like Aave, uh but also others. So, our builders are the one competing uh with Aave in some way. So, yeah, that's like the one the first like, you know, uh explanation. The second explanation is actually Morpho is a stack that is heavily focused towards real world loans. So, 90% of our volume is stablecoins in terms of active loans, right? And like to give you an rough order of magnitude in DeFi lending, 50% only is is roughly like 50-60% is of active loans are in stablecoin. A lot of a lot of it of the rest is like ETH restaking loops and ETH staking loops and and others. We don't get to focus too much on that on Morpho.

We think stablecoin loans is what truly is going to be the true scalable market if we truly want to unlock like real world lending and everything. And so, this is the only place where we spend our time and and energy as as a team. So, I know that this question may not apply to how Morpho is set up because as you mentioned, it's really the curators who are setting the parameters on, you know, each of um you know, on on what they're managing. But um you might have heard that there was a report published on Dirt Roads uh by Luca Prosperi, which kind of used some different frameworks to kind of analyze how much DeFi lenders should be compensated for the risk that they take on when they lend on DeFi.

And um according to at least one of those analyses, it found that they are grossly undercompensated. Uh and in that model, they said that that's because what they're doing is essentially similar to a put option. Um however, you know, there there's been some disagreements. Take House Financial also um kind of had their own analogy for what's happening in on-chain lending, and they uh compared that to actually repo agreements. Um and and so, they didn't feel that that DeFi lenders were being undercompensated for the risk. Um but I'm sure you see there's a lot of Twitter um you know, conversation about this as well. So, I was wondering what your opinion is generally on, you know, how to properly compensate DeFi

lenders or even how to sort of calculate what risk they are taking on. Yeah, it's it's a great question, and I think, you know, obviously the answer heavily depends on what, you know, are the the the underlying strategy of the vault or of the lending lending protocol. But I I say the following is that the the the risk range can vary a lot depending on the type of assets that you underwrite. We found that, you know, over the last, you know, few exploits that has been uh in in DeFi it's actually mostly related to opsec, uh which is maybe not something that is as well underwritten and priced by the market as it should be.

Um and so, our position as Morpho is that the the we should provide a market infrastructure for lenders and borrowers to price trust, right? And what I mean by this is that borrowers should expose why they should be trusted, like the collateral they have uh or the identity they have or whatever, and then the lenders is an open marketplace, the rate should be determined uh by by by them. And and so, and and in this capacity, we don't we don't have an an an opinion on like, you know, what should be like the the risk-free rate uh for or like the the different risk uh premiums. Uh but we feel like it's for the market to discover that basically within within the permissionless like

uh stack. Um now, specifically, I haven't read the study of Luca, uh neither the answer from from from Stakers Financial. Um I I the the put option framing is very weird to me. I think it's much closer to like I don't I don't see how that would be close to to a potential especially as we move towards more and more undercollateralized loans in the Morpho stack. Um um to me like the analogy and how we explain this to traditional finance, etc. is that it's much closer to a repo agreement. Um and and this is the lens through which they understand and think themselves about pricing.

And when you think about the the risk of such a repo-like structure, you have obviously the market structure, which is the Morpho protocol contract, where you have a risk of smart contracts, uh which, you know, uh I like to believe has a very very low uh premium. Uh then you have the risk of the collateral, the pricing of that collateral, and the liquidation loan-to-value. And all this together is actually very few trust assumption. And if you take high-quality collateral like Treasury bonds or or or Bitcoin and and reliable price sources, I think there are fair arguments to make that the the price of of of trusting those loans is actually or or the risk of those loans uh can can actually be very close to the

one in TradFi and does not require crazy premiums. I've seen some tweets like going for like pretty crazy numbers. I won't comment on that, but I think it's pretty far away from the reality. And um I'm sorry, but does that then also compensate for just the risk of um sort of those opsec reasons that you discussed because, you know, as we know, a lot of these hacks are not even of the protocol. It's like literally just around key management and and stuff like that. Yeah, no, I I I think it's just depending on what asset we're talking about. Uh if we're talking, you know, WETH uh as collateral on the Morpho market priced by an oracle like like Chainlink,

uh honestly, I I don't think there is such like risk because there is no like such thing as a multi-sig behind the scenes anywhere in in the process. Um however, uh if we're talking this new, you know, wrapped RWA that is done by a startup that did not even have like, you know, basic offset procedures, then yes, that should absolutely be priced in. The reality though, it's very hard uh uh to to properly underwrite those those assets. Now, we've seen like all the fintechs we've been working with, they're much more careful about this now, obviously. And so so they require our curators to like provide, you know, proper uh due diligence on every single of those assets, including assessment of the offset best practices, uh we which is, you know, not something

they would expect maybe a year ago. Um and so that has been that has been interesting to see as well. Okay, so yeah, one other um kind of you know, aspect of this that I wanted to explore in terms of risk was just um you saw that after it was revealed that um you know, the LayerZero bridge had uh sort of, you know, out of the box had a one-of-one setup for the DVN, then there was some finger-pointing going back and forth between KelpDAO, LayerZero over who was really responsible.

Um but I was curious like, you know, how do you think about that? And how do you think users who want to engage in either DeFi lending or borrowing, how should they, you know, pers- like, you know, judge whether or not something is safe for them to engage with? Right, I think it really comes down to like what's is the uh how much assets your lending protocol uh is underwriting and how, right? When you have like a a pool model or a hub model that is underwriting like 50 different assets, even though the caps are small, right? We're talking like in the case of

Aave Aave used to be a very big like, you know, 40 billion-dollar uh like protocol and the cap for cap was like I don't know, but maybe 200 million top of mind. So, you know, one looking at this would be like, "Oh, actually, that sounds like a very minimal exposure compared to the size of uh of Aave." But the but the reality is that even the small exposure or relative exposure can trigger panic, which turns into a very big relative exposure uh as as as we've seen. And I think this is really fundamentally like duplicating the number of assets underwriting into a single pool model that aggregates the liquidity for everybody.

Like you multiply the black swan risk by, you know, even though at the high level those assets individually look safe, then you have to imagine that each of those assets rely on 10 different providers that rely on 10 different providers that relies on RPCs that can be hacked by North Korea, right? And if you are a lending pool like Aave of 40 billion, technically, you should have continuous monitoring of those 40 different assets, the 10 providers of each of those 40 different assets, etc., etc., which is absolutely unrealistic, especially if you ask token holders to do it, right?

Which is basically like the the the the process of a monolithic lending pool today is like token holders have to approve those vault parameters, those those risk parameters changes, which to me is not is not a really a good expectation from from from from token holders. Even a centralized risk service provider is too complex, right? Especially if the risk provider can leave at any point in time, as we've seen, right? And so that creates an in my opinion too too much risk. Okay, and um you know, as you mentioned before, when people are engaging in Morpho, you know, they should sort of analyze each vault and like look at the curator. So, how do you assess you know, whether

like a curator is kind of doing their due diligence versus one that maybe is less trustworthy? Yeah, so it's a great question. One should think of Morpho's position as Etherscan almost, right? Or or Ethereum for credit, right? So, if you go to our interface, you're going to have this terrible UX, I'm going to be honest, where you're going to have hundreds and hundreds and hundreds of vaults, right? And for each of them, we're going to give you a ton of details about what is the risk, what they do, what is their track record, etc. We're not providing a consumer, you know, easy-to-use UX. If you are a simple user that does not want to think about those things, you should go to one of the 200-ish like, you know, the partners that are integrating Morpho

that are providing those experience, you know. We integrate with every single exchange, right? You know, whether that is like Binance, OKX, Gemini, Kraken, you know, Coinbase, obviously, and and and and others. They they get to do the work of picking a curator and and and you know, making sure that those vaults are have the proper risk configuration for their users, the proper, you know, risk isolation, right? And and and and this is how users that don't want to choose to use those interfaces. Users that are more experts, right? And want to understand and go deep the same way you would go deep on Etherscan if you know perfectly Ethereum and what you would do or through a terminal directly, then you go to the Morpho platform or to the Morpho API or to the Morpho contract

directly. That's really how we think about it. And by the way, I think this is the only way to scale DeFi lending, right? I don't like I want 7 billion people on Earth to benefit from on-chain loans, right? And and an open credit network. I'm not going to underwrite or Morpho is not going to underwrite 7 billion people. We're going to need thousands and thousands of curators, banks, asset managers, whatever you want to go after each borrower in the world and and give them a price for a loan, right? And we don't we won't do it all of this. We just provide a connecting layer for everybody in the stack for everybody to do this underwriting and access global and competitive liquidity.

And to me, this is what DeFi is about. DeFi is not about decentralized underwriting or decentralized brokerage. DeFi is about providing an open marketplace for financial activities that you have in TradFi. Except now, because it's open, you have better price discovery, which means, you know, deeper liquidity and better prices for end users, and better discoverability of the different products. So, in practice, it comes down to it's going to be cheaper and you're going to have more types of products. It's going to be the exact same products that you would have before, maybe slightly different, but the pricing is going to be so much more efficient because you connect globally to everybody.

And one other question I want to ask um I you know, I know that with all of this contagion that happened in DeFi that you had a lot of conversations with institutions, and Morpho itself is known for being part of one of the um it's it's actually probably the best-known sort of DeFi mullet setup in all of crypto, um you know, with the Morpho protocol powering crypto loans on Coinbase. What effect are you seeing that the KelpDAO attack and and the ensuing DeFi contagion is having on institutional appetite for these types of arrangements?

Right. Well, you know, with the when when the Kelp situation happened, um the first thing I thought uh and like, you know, when when Aave went illiquid and like had, you know, 12 billion dollars blocked, I you know, I I felt good about Morpho because of how Morpho operates and and its position, but I was like worried about the institutions reacting to this. Because in traditional finance, when if you freeze more than 10 billion dollars for a week, like this is a very serious issue, right? And and so I picked the phone and I started to call them. And I was like, "Hey, you know," explaining what's going on and so I, you know, making sure they understand um the uh what what what is happening.

Um and I think, you know, I was actually There's there's a positive thing and the negative thing, right? The the positive thing, two positive things, is they understand that this technology is the future regardless of of, you know, what's happening on chain. They understand that having an open global financial system is a prom- promise that is way too big to fail, right? Like this it it they are all convinced that this is what we're marching towards as a technology. What they're not convinced by is the current way we're doing underwriting, right? And they're basic- their basically their reaction is like, "Oh, yeah, DeFi, you guys are are jokers, right? Like the way you underwrite is

not serious at all, right?" And and you know, to to some extent, it's hard to prove them wrong. Like currently with like the track record that we have over the last few months with so many hacks happening, etc. So, I think the question is like, how do we empower them with technology that they can trust, that they can control, and what I mean by control is that they can use and and configure without having to rely on trusted intermediaries uh in order to operate the financial services that they operate in TradFi with the same scale and trustworthiness that they would uh in the in in in the the off-chain world. And so, TLDR is that they are convinced by the technology. A second big reason is that they're convinced by the business aspect of things, which is they see all the

fintechs coming on chain, every single fintech coming on chain, and they're like, "Hey, all this AUM that I have from the fintechs today, I'm going to lose it to Morpho vault. So, guess what? I need to come on chain and manage my own Morpho vault and become an asset manager on chain, because otherwise I'm going to lose flow coming from all the fintechs." So, they get this, right? But now now and and they even see this as an opportunity. They're like, "Hey, the current asset managers that are decentralized like Aave are not doing a good job. It's an opportunity for me to come over and take this market uh powered by like the the the the the Morpho technology, if you will." And and so that's the the the upside. The flip side is, you know, obviously the most conservative institutions, they're like a huge setback for them uh in terms

of like, you know, how they can trust like how they can effectively go to their leadership and push like the pitch of like, "Hey, we're going to move on chain and deposit funds." And it's it's just makes the pitch much harder internally if the organization is not already convinced by the technology and there is not like top-down like, you know, direction that the on chain is the future. If you're not in one of those an organization, then it's going to be much harder now to sell the on chain vision. And if you were to kind of put a number on it, like would you imagine that this sort of delayed some of those decisions by like 3 months or 6 months or like or or maybe not, but I'm just curious.

It's a great question. It definitely would be some delay. Even not just from the TradFi institutional player, but from the fintech adoption side of things. And and right what you saw, right? Like you want to take a step back and understand what happened. You maybe want to change yield provider and loan provider as well. And and then reflect, right? And also think, you know, about the question that we just discussed, which is the risk premiums. Like is it worth it, right, to move on chain? And it's our job to prove that it will be worth it, that you'll get better price discovery, that you'll get access to opportunities that are much harder to get otherwise. And this is where we need to do work, right? Is like keep like, you know, the the security uh

aspect of it flawless, but at the same time make it convincing enough from a financial product perspective. So I think we can fairly say that we've lost 3 to 6 months of institutional adoption uh for I'd say an average. Some people have seen our nuts laying down at all. They get the difference between like a Morpho and an Aave, for example. And they they understand that things can be isolated and cetera. But for the most conservative ones, you know, it's probably delaying them even in years, you know. Oh, wow. >> It's a bit scary when you say this, but you know, and you know, I'm only speaking like specifically I have it I meant two persons I I talked to and they're like, "Wow, actually that, you know, that was a big big thing." Wow.

Okay. I mean, honestly, it makes sense with the way like AI I think is affecting um you know, the ability for hackers to do these exploits. All right. So in a moment we're going to talk about some of the um sort of rescue operations that happened that were a little controversial. But first we're going to take a quick word from the sponsors who make the show possible. Bitcoin changed how money works. Satraea changes how Bitcoin scales. Satraea uses Bitcoin as both the settlement and data availability layer. >> [music] >> As Bitcoin's application layer, Satraea enables the first trust minimized BTC on a fully programmable platform and a native stablecoin for Bitcoin, CTUSD.

Satraea offers Bitcoin capital markets with lending, privacy, payments, Bitcoin yield, trading, and predictions. Satraea expands Bitcoin's utility without sacrificing its security. Satraea mainnet is live. Get started at satraea.xyz/unchained. Etherfi is giving Unchained listeners 15% cash back on ride shares, groceries, and restaurants right now, which honestly is kind of wild for a card like this. On top of that, I'm getting 3% cash back on every single transaction using my actual crypto. No conversion fees, no nonsense. My bank never once did that. And it goes beyond just spending. You can borrow against your

holdings at 4% or less, which is super useful if you don't want to sell your assets. You can also earn on all major assets up to 8% APY just by holding. And moving money is just easy. No hidden transfer fees, no friction. It just works globally. If you want to check it out, go to ether.fi/unchained to claim your offer. That's ether.fi/unchained. Back to my conversation with Paul. Well, after the big hack and the contagion, the Arbitrum Security Council had this moment in time where they saw the stolen funds sitting there for a period and they used that time to freeze about $71 million worth of the stolen

funds. Uh this was a pretty controversial move. At least at least, I don't know, at least in parts of Twitter. I think other parts was not controversial, but I'm curious, what was your opinion on it? What did you think that was the right thing to do or or the wrong thing? It's a great question. To be frank, it's hard to to answer. It's such a tough decision. So I, you know, I know the Arbitrum team has put the thoughts into it before taking it and I don't have the full context myself. So it's hard to judge if it's a good or one, but I trust the Arbitrum team like seriousness and thoughtfulness to effectively have taken the right decision. Now, generally about censorship resistance and and you know, ability to like, you know, freeze funds

on behalf of users, etc. I think it it comes down to personal personally, it comes down to if you can do it, then not doing it feels a little bit immoral. Again, every situation has all its context, right? But and it's interesting because as soon as you can't do it anymore, it's not immoral at all because you just can't do it. It's like a little bit like the contra- decentralized internet versus controlled internet, right? Like you don't expect you know, there's no one owning HTTP. So you can't prevent them from operating a specific website, which one could think as as as a good thing. But but if someone were to own HTTP in some capacity and there was like a

a specific website that was doing harm very clearly to humanity overall, then it's hard to justify not shutting it down, right? So it's very interesting tension where like between control and the the morality question that is behind the action that are are are being taken. So anyway, it's kind of like a non-answer, but you know, I I I I have very high trust and and respect for for the Arbitrum team in general and I trust that they they did not take the decision lightly for sure. And also trust that we don't have all the context, right? So maybe there are the reasons we don't know about. Yeah, and just to be clear, it was the Arbitrum Security Council, which is like outside people. So Yes.

Yes, that's right. >> Yeah. So yeah, it wasn't actually like Offchain Labs or anything like that, but um yeah. I I do believe um there was a lot of discussion around that. And and for people who are interested to learn a little bit more about how it went down behind the scenes, um Griff Green came on the show on Friday and talked about, you know, uh from his perspective as a security council member, um you know, how he felt it came about. And he also described technically how it worked, which was also actually really interesting. Um so after that rescue, we then saw this DeFi United effort that began picking up steam. Earlier today on Monday, it finally hit its um goal or

really exceeded it, frankly. Um so the amount pledged by the likes of So so the people who pushed over the edge were Joe Lubin in ConsenSys. Um they pledged, you know, ether to to help make people whole. Um Lido, uh Kelp DAO, obviously Etherfi. Um I think the Solana Foundation pitched in. Um there were a number of entities, you know, that that wanted to help cover this bad debt in Aave from from the attack. I wondered what you thought of that as a way to address what happened.

Yeah, it's a great question. And I I got to be honest, I don't fully know what is DeFi United. You know, I saw the announcement on Twitter, but I also heard like it's a donation and then I heard it's like a loan that is undercollateralized and, you know, so I I'm not exactly sure what happens with the funds. And so I don't know if I can I can provide a good perspective on this. Yeah, I saw somebody tweet it's a mix. But I my- I myself, yeah, don't have all the details, but I saw it was a mix. Right. And and then, you know, every time like we got proposals on this. It was like a different different terms for the loans, etc. So I'm I'm not entirely sure. So it's hard to give a perspective on this. It's also hard to know what are

the incentives of of of of people. Like yeah, for sure, if you have like a 200 million bad debt hole, you're going to donate for yourself. So of course you're going to contribute. But what's in it for the other people to to to contribute in there? And uh just not having this full transparency for me is a bit weird if it goes public and anyone can deposit into it. It's actually was one of the conversations I had with some institutions like having the same concerns as as as I have. It's like not truly understanding what's happening, which is, by the way, very different from a recovery process that you would have in traditional financial world. And and again, like this doesn't mean because TradFi that it's not a way that we can't innovate and do new things. I just, yeah, um

I'm I'm just not sure what it does exactly to to to be completely honest. Yeah, I mean, um I agree like it's not ideal. Like it would it would be it would have been better to just, you know, have prevented the hack, obviously. But um on another show that we have Dacks in the City, some of the lawyers were saying that if the industry doesn't kind of like self-regulate, then the regulators are going to come in. So >> [laughter] >> in that regard, like maybe maybe it's good that there is some industry effort to kind of, you know, remedy what happened.

Um but, you know, let's just now zoom out a little bit because obviously this has been a really rough month for DeFi. There was the Resolved hack. There was Drift. Now it's Kelp DAO, which had this sort of massive contagion effect. So, you know, now with all of that going on, like are you just having thoughts as a DeFi founder about, you know, what the industry needs to do, you know, how this sector can kind of stabilize, and how, you know, what sort of steps need to be implemented to grow into mainstream adoption?

Well, for what it's worth, from our selfish perspective, uh we had the best months in terms of enterprise adoption of Morpho, right? We're at all-time high in terms of like every enterprise integration that we have that is directly plugging into the protocol, which is the thing I care the most about is how can we take DeFi to the masses, etc. And this is working and working well. If you take like the Coinbase isolated, you know, lending markets, we reached a new all-time high yesterday, right? Despite the price being super down like in general, right? So, to me it's not just that DeFi is at risk. I think DeFi 1.0, like the old era, like kind of maybe, but I think, you know, it's just metamorphosing without playing on words,

like before what it was su- you know, supposed to be, and now what it is is like, you know, financial infrastructure for fintechs, for traditional financial institution, that is live and growing and has immense potential, immense potential. We're talking like the credit market is $200 trillion, right? Uh and we're just with crypto back loans, we're just 50 billion. It's like tiny, and there's so much, you know, room room to grow in that direction. Yes, the very crypto-native, you know, uh leverage loop is is in the tougher spot. Uh uh I agree, but it's also not where we spend too much time, nor what we get excited about. Right. And so, as a result, as a DeFi founder, to answer your question,

you know, I'm just worried about the perception, right? That's the only thing, right? Fun- The fundamentals are here. I'm very, very convinced of it about, you know, DeFi upgrading the financial system for for everybody. It's just how long it's going to take to get there, and will the short-term events of DeFi 1.0 going to impact the perception that would prevent DeFi 2.0 to thrive. And this is what I try to mitigate as much as possible. And so, you talked a little bit about how institutions are sort of like changing their approach or or changing at least their thinking around this area, but what are you seeing in terms of like user behavior change?

Fair question. So, I mean, very clearly it's like, "Hey, if you're like, you know," and have conversation many conversations like this last week, he's like, basically people only want to exposure to Bitcoin yield, like the two USDC yield that is just powered by Bitcoin. So, when when you talk to fintechs, some of some of them are like, "Hey, well, you know what? Actually, we're going to change our strategy. It's going to be a single I- not even multiple isolated Morpho markets, a single Morpho market with just Bitcoin as collateral, because we know this is like a good risk-reward trade-off." And so, the the short-term implications for us is that they're going to be much more careful about growth and and and just risk-taking in general. And

rightfully so, right? In general. So, isolating as much as possible their risk, understanding their risk level so much more. Like, we've seen them higher lots and upgrade a lot. There's, you know, their competency level on those matters as well. To the point where I feel like now they have, you know, sometimes much higher crypto-native talent density than the crypto-native projects themselves. And so, I'm not even sure if this question applies, so tell me if if it doesn't, but as we mentioned with AI and um and even the quantum threat, which I know is further out, but still like there's just clearly more um you know, attack vectors that are being found. Um also, as we're seeing, the human aspect

of all this is being exploited with social engineering being a major avenue for DPRK. So, I was wondering like, you know, how is Morpho adapting in this sort of new era? Um and I'm sure there's probably some aspect that you may not want to reveal, but I'm just curious like, you know, how are you thinking about how to make sure everything, you know, stays secure and your users stay safe? It's a great question. Um I think, you know, one of the biggest defense of the traditional like, you know, financial system is is the lack of transparency, right? From a cybersecurity perspective, there's nothing you can see, so it's much harder

to attack. Um in DeFi, everything is open, so if you start having very powerful tools, well, DeFi is like kind of like an obvious target. It's like open, you can audit everything, you can send your your best LLM and and spend $2 million of compute on like finding bugs everywhere. Um and and that is very very interesting because like the force is shifting way too much into the hands of the attacker versus the the the developers on the other end. I think on the flip side, we have one tool that I think is extremely powerful to reestablish balance between the two, which is formal verification right?

AI can break a lot of things, right? But it still, until today, can't break math, right? And so, if you build a protocol like we did, which is extremely simple, with uh specifications that are formally verified, well, it doesn't matter if you're Mitos like V5, or or if you're like a junior security researcher, you won't break this math, right? Because it's math, right? Um and and what's interesting about this AI era for Morpho is that we've already thought of our models and like our our code as deployed forever.

And it's extremely different when you put them from the developers' perspective, immutable protocols from the gradable protocol. We had both. Before Morpho in the old era, Morpho was upgradable, and we thought about it very differently, because if you're immutable, you're going to be here forever. So, if there is just a small chance that you'll be hacked, well, if you integrate this risk over infinite period of time, you'll be hacked eventually. So, you have to change your thinking and say, "Hey, it's it's like a zero-risk model. It has to be flawless, right? To the eyes of any researcher in the future, including AI Mitos like V.10."

Um and so, so so, we feel good about the on-chain side of things, regardless of the power of the AI gods that we're going to summon. Uh what I'm worried about generally for DeFi is also is like all the off-chain stack of things, right? And this is where we've been spending a lot of time uh internally upgrading all of this. So, in Morpho, you don't need to rely on the the off-chain stack of Morpho to to do stuff, but the reality is like we have a front end. So, if you go to morpho.org, and it's actually a phishing scam. Like, we've seen so many DNS attacks of like other other players, so we need to double down and be very careful about this. But, that's like, you know,

the the $12 billion that are on Morpho that are on the smart contract, not our front end, obviously. So, we we we feel good about that. All right. Well, Paul, this has been such a pleasure talking with you and learning more about, you know, other ways that borrowing and lending occurs in DeFi, and also the institutional reaction to all of this. Thank you so much for coming on Unchained. Thank you. And for those of you who are watching, next up we have the Bits N' Bips crew. They'll be discussing the arrest of the soldier who made up that on Polymarket on a Maduro's capture. And they'll also talk about the Tether freeze of $344 million in Iran-related funds and more.

So, stick around after this short break. >> [music]