Institutional participation in decentralised finance is often reduced to one question: has the protocol been audited? That is the wrong unit of analysis. An institution does not interact with code in isolation. It relies on a chain of contracts, price feeds, bridges, administrators, signing devices, transaction simulators, web infrastructure, service providers and legal decisions. A failure at any link can produce the same outcome: an irreversible transfer, an unhedgeable exposure or a breach of duty.
The institutional threat model must therefore cover the complete path from investment approval to exit. It must ask who can change the system, what external facts the system trusts, what the institution's signers actually verify and which controls still work when a protocol, vendor or public blockchain is under stress. This is not an argument that DeFi is uniquely unusable. It is an argument that its operational reality is wider than its smart contracts.
As at 8 September 2026, the useful starting point is a layered model with explicit loss limits, evidence requirements and stop conditions. The January 2025 joint report by the European Supervisory Authorities reaches a similar systems conclusion: smart contracts can be compromised through their own flaws and through infrastructure, interfaces, composite contracts, compilers and oracles. Composability transmits weaknesses rather than containing them.
Start with assets, authority and irreversible outcomes
A threat model begins before protocol selection. Define the assets at risk, including principal, accrued rewards, collateral posted elsewhere, governance rights, client data and the institution's reputation or licence. Then map every authority capable of moving those assets or changing the conditions under which they can be moved.
The map should include user keys, policy engines, custodians, relayers, contract owners, proxy administrators, emergency councils, oracle operators, bridge validators, governance delegates, domain registrars and software publishers. For each authority, record its threshold, delay, revocation process, monitoring and maximum credible loss. A label such as decentralised or non-custodial does not answer any of those questions.
Separate three events that risk registers too often combine: loss of funds, loss of availability and loss of legal ability to transact. A paused market may preserve funds but trap collateral during volatility. A sanctions alert may require a hold even while an on-chain liquidation clock continues. A chain reorganisation or sequencer outage may leave a position economically exposed although the application appears online. Different events need different limits and response owners.
Smart contracts: reason about change, not badges
Contract review should establish exactly which bytecode will hold or control assets, whether it is verified, whether it is upgradeable and which dependencies sit outside the reviewed repository. Audits are evidence, not warranties. Scope, commit hash, unresolved findings, deployment match and changes since the report matter more than the number of audit logos.
The Euler V1 exploit is the sharpest warning against badge-based diligence. According to Euler's retrospective account, an attacker exploited the protocol on 13 March 2023 for about $197 million. A function added in a previously audited upgrade, donateToReserves, lacked a health check. The attacker made an account eligible for liquidation and self-liquidated it for a bonus. Euler later recovered the stolen assets, but recovery through negotiation was an exceptional outcome, not a control.
Institutional review should combine static analysis, adversarial testing and economic simulation. The scenarios should include re-entrancy, rounding and accounting errors, access-control failure, bad initialisation, unexpected token behaviour, liquidation spirals, flash-loan-funded state changes and dependency failure. Tests must cover privileged upgrades and unusual paths, not only ordinary deposits and withdrawals.
Production controls should assume an unknown bug remains. Set protocol and strategy exposure caps, diversify by genuinely independent failure domains, use allowlisted contract addresses and functions, and place timelocks between governance approval and execution where architecture permits. Monitor bytecode, proxy implementations, owners, parameters and new asset listings. A change in any of them should trigger reapproval, not silent continuation.
Oracles: define the market the contract can see
An oracle does not reveal an objective price. It applies a methodology to selected venues over a chosen period, then delivers an update under stated conditions. The Bank for International Settlements' bulletin of 7 September 2023 describes the central trade-off: more centralisation can improve efficiency but introduces trusted parties into a system intended to minimise trust.
Diligence must inspect data sources, venue quality, aggregation, update cadence, deviation thresholds, decimal handling, sequencer checks, fallback logic and governance. Ask what happens when liquidity migrates, a constituent venue halts, the reference asset depegs or gas congestion prevents updates. A time-weighted average may resist a brief manipulation yet lag a genuine crash. A spot feed may be timely yet easier to distort in a thin market.
Controls should reject stale or out-of-bounds data and constrain the action a single update can cause. Institutions can require independent reference feeds, conservative loan-to-value ratios, liquidation buffers and circuit breakers based on both price and market depth. The goal is not to predict every bad print. It is to ensure that no single feed, venue or update can convert a transient data failure into an unlimited balance-sheet loss.
Bridges: underwrite a separate security system
A bridged asset is a claim created by another verification and custody system. It is not operationally equivalent to the native asset. Review how messages are authenticated, where backing assets sit, who can upgrade or pause the bridge, how validator keys are distributed, what finality assumptions apply and whether rate limits bound a compromise.
Nomad reported that its token bridge was hacked on 1 August 2022 for more than $186 million, with more than 300 addresses participating. Its root-cause analysis dated 5 August 2022 explains that a 21 June upgrade left the zero root pre-approved. Because an unproven message also returned zero from the relevant mapping, forged messages passed authentication. The combination made the failure easy to repeat across many addresses.
Institutions should inventory exposure by bridge implementation, not just destination chain. Caps should include direct bridge use and indirect holdings in pools, collateral and vaults containing wrapped assets. Prefer canonical routes only after assessing their administrative and chain assumptions. Require proof-of-reserves or backing reconciliation where available, watch for mint-and-lock imbalances, and define an immediate freeze condition for abnormal issuance, validator changes or disputed finality.
Keys and signing: verify intent independently
Multisignature approval reduces dependence on one key only when signers, devices, software and verification channels are meaningfully independent. Three people approving the same misleading screen is not three independent controls. A cold wallet can still authorise a harmful transaction if the data presented to its signers is false.
On 26 February 2025, the FBI attributed the theft of approximately $1.5 billion from Bybit to North Korean TraderTraitor actors. Bybit’s timeline says the theft followed a routine transfer from an Ethereum multisignature cold wallet on 21 February 2025. It says the Safe interface was spoofed so that signers approved a transaction that changed the wallet’s smart-contract logic. The lesson for institutional DeFi is broader than one vendor: signing policy must authenticate semantic intent, not merely collect signatures.
Use transaction simulation from a separately controlled system, decode calldata, verify destination contracts and compare expected state changes against policy. High-risk operations such as proxy upgrades, delegate calls, approvals and owner changes should require an enhanced quorum and an out-of-band challenge. Separate proposers from signers, cap approvals, use purpose-specific vaults and enforce velocity limits. Key rotation, signer loss, coercion and vendor compromise need tested procedures. Recovery credentials deserve the same protection as active keys.
Governance: model legitimate power and hostile capture
Governance is part of the attack surface whether it is conducted by token vote, multisignature, foundation or administrator. Review token concentration, delegation, quorum, proposal delay, voting snapshots, execution timelocks, emergency powers and the ability to replace implementation code. Identify which powers can seize funds, change collateral factors, replace an oracle or disable withdrawals.
Beanstalk's current disclosures state that on 17 April 2022 an attacker used a flash loan to compromise on-chain governance and steal about $77 million in non-Bean assets. The protocol paused, removed its autonomous on-chain governance and moved to off-chain voting with execution by a five-of-nine community multisignature as an interim security measure. Governance that can act instantly can also be captured instantly.
An institutional policy should set minimum notice and exit windows for material changes. Monitor proposals from creation through execution and assess payloads, not titles. Delegation relationships and voter concentration should be visible. Emergency councils can reduce response time, but they add key and insider risk; their powers, membership, replacement and transparency must be underwritten explicitly. If a protocol can change material terms faster than the institution can detect, decide and exit, exposure should be reduced accordingly.
Front ends and software supply chains
The blockchain may behave exactly as designed while the user is deceived before signing. Domains, DNS, content delivery networks, browser extensions, wallet connectors, analytics scripts and package registries all sit in the transaction path.
Ledger's 20 December 2023 incident report says a former employee's package-registry access was not revoked. After phishing obtained that access, malicious Ledger Connect Kit versions were published on 14 December 2023 and dynamically loaded by decentralised applications. Ledger estimated that assets were actively drained for less than two hours. More recently, Curve reported on 19 May 2025 that its .fi domain had been hijacked at registrar level on 12 May 2025, without a breach of Curve's own infrastructure.
Institutions should not permit treasury transactions from an ordinary browsing environment. Use a hardened workstation, approved bookmarks, DNS and certificate monitoring, dependency pinning, content-security controls where the institution operates an interface, and independent transaction decoding. Verify contract addresses through more than one authenticated channel. Front-end failure must be able to stop a transaction, never redefine what the signing policy considers safe.
Sanctions and compliance: code availability is not permission
Permissionless execution does not remove obligations from regulated institutions or identifiable service providers. Compliance analysis must follow the institution, activity, counterparties and jurisdictions, not the protocol's marketing label.
The FATF guidance of 28 October 2021 applies a functional test to DeFi. Creators, owners, operators or others with control or sufficient influence may fall within the definition of a virtual-asset service provider, depending on the facts. In the EU, recital 22 of MiCA says fully decentralised services without an intermediary should fall outside that regulation, while activities performed, provided or controlled directly or indirectly by undertakings, including partly decentralised services, are within its intended reach. That distinction is fact-sensitive, not a self-certification.
For US exposure, OFAC's 15 October 2021 guidance recommends a tailored, risk-based programme using sanctions screening, geolocation, customer information and transaction monitoring. Lists change. OFAC removed Tornado Cash entries from the Specially Designated Nationals list on 21 March 2025. The same notice retained a separate sanctions entry for Roman Semenov, illustrating why institutions must screen the parties and addresses involved rather than infer legal status from a protocol name.
Controls should screen addresses and entities at onboarding, before execution and during asset receipt; preserve the list version, timestamp, data source and decision; and assess indirect exposure, ownership rules, geographic signals and chain-hopping. A vendor score is an input, not a legal conclusion. Escalation rules must distinguish a confirmed prohibition, an exposure indicator and an unavailable data source. Legal counsel should define when funds may be rejected, frozen, blocked or reported in each relevant jurisdiction.
EU financial entities should also connect DeFi dependencies to operational-resilience duties. The Digital Operational Resilience Act has applied since 17 January 2025 and addresses ICT risk management, testing, incidents and third-party risk. Calling an oracle, interface or custody workflow decentralised does not make the institution's dependency disappear.
Incident response: design the exit before entry
Traditional cyber response is necessary but insufficient because assets can move while investigators assemble. The playbook needs on-chain decision rights, pre-authorised containment actions and contacts across protocol teams, custodians, stablecoin issuers, exchanges, analytics providers, insurers, counsel and law enforcement.
NIST's Cybersecurity Framework 2.0, released on 26 February 2024, organises resilience around Govern, Identify, Protect, Detect, Respond and Recover. An institutional DeFi plan can make those functions concrete:
- Detect and classify. Alert on abnormal approvals, owner or implementation changes, oracle divergence, bridge imbalance, governance proposals, signer anomalies and sanctions-list updates. Determine whether the event affects confidentiality, transaction integrity, solvency, availability or legality.
- Contain safely. Revoke approvals, cancel queued transactions, disable automation, isolate signing devices and reduce positions only when doing so does not worsen loss. Know in advance which actions require governance, custodian or counterparty cooperation.
- Preserve evidence. Record transaction hashes, block numbers, decoded calldata, screenshots, logs, device state, communications and exact timestamps. Do not destroy forensic value through hurried device resets.
- Communicate by authority. Assign one incident commander. Maintain separate technical, legal, regulatory, client and public workstreams. State confirmed facts, estimates and unknowns separately.
- Recover deliberately. Rotate affected credentials, rebuild from trusted systems, validate contract and front-end integrity, reconcile every position and obtain formal approval before resuming. Recovery is not complete when a website returns.
Tabletop exercises should include a simultaneous technical and compliance event: for example, an oracle anomaly during a sanctions alert while collateral is close to liquidation. Measure detection time, decision time, executable exit capacity and evidence quality. A paper plan that assumes all counterparties answer immediately is not a tested plan.
A defensible admission standard
An investment committee needs a concise decision record, not a hundred-page assurance pack. The record should identify contracts and chains, maximum exposure, upgrade and governance authorities, oracle and bridge dependencies, signing route, compliance perimeter, monitoring coverage, exit liquidity, incident owner and unresolved exceptions.
Admission should be conditional. Useful conditions include a hard notional cap, no bridged collateral, no unlimited approvals, a minimum governance delay, independent price monitoring and automatic suspension after an unreviewed upgrade. Exceptions need an owner, expiry date and compensating control. Evidence should be refreshed after every material change and on a fixed schedule even when nothing obvious changes.
The correct institutional question is not whether DeFi is trustless. It is where trust, authority and irreversibility remain, and whether the institution can bound them.
No framework makes permissionless finance safe in the absolute. A credible one makes the residual risk visible, prices it against the institution's appetite and gives operators a rehearsed way to stop. That is the difference between experimenting with a protocol and underwriting an institutional system.