The best zk-permissioning platform in DeFi is now free! Today marks a major milestone in our maturity, one where we realised that some products are just better as relationship-builders. In a tight-knit industry, where relationships mean everything, we are proud to reach a point where we can give our zk-permissioning tech out to anyone that needs it for no charge.

We’re sharing our completed post-mortem on the April 18th incident, prepared with @Mandiant and @CrowdStrike. We are publishing both an executive summary and the full report at the link below. Over the past four weeks, we’ve worked with hundreds of partners to help them understand their current security posture, and harden it where appropriate. We’ll continue this work, alongside taking additional proactive steps for the benefit of not only our partners, but also the ecosystem as a whole. We want to extend our thanks to our partners for their support and patience this past month. There’s a reason that over $12 billion has moved across the network in the past four weeks, and why the world’s most valuable asset issuers have stood by our side: they believe in us, in what the LayerZero protocol has to offer, and in the value of modular, isolated, application-controlled security. The work continues. And we look forward to continue showing up for the applications that trust us with their business, as well as the broader ecosystem. layerzero.network/blog/layer…

In DeFi you're as secure as your weakest integration. Glenn Morgan & @AlexKrasnow from @Aon_plc made this clear in our latest episode of The Ship Safely Podcast: One compromised dependency creates exposure you didn't model for and it's the first thing an insurance company like AON looks at before a policy conversation even starts. Full conversation here:

How do you get DeFi insurance for under 20bps? It all relates to how much insurance protocols should actually pay for per TVL. From shopping around, I can confidently say that the price in the market being offered is between 1.5-4% on lending and borrowing crime insurance. "but.. but.. you said the expected value is 3bps" yes but the insurers are: 1) skittish about cover, and 2) they have to take into account Expected Shortfall, and given no-one is buying cover they have pretty high concentrations on what they write. How the hell do you get to <20bps when you're paying 2% ? Start with defn of protocol crime insurance for hacks: - exclude bridge-related events - Solana and EVM - Protocol exploits or oracle manipulation involving a theft, a few others things too but it's PROTOCOL stuff Lets also give an explicit counter-example... START EXAMPLE SIDE QUEST >>> As a concrete example, most people in crypto talk about the "Aave hack". @aave didn't get hacked by any stretch of the imagination, you would definitely know if they did. @aave had a credit event. A collateral lost its peg because of an error in technical configuration. That error was propagated from a criminal cyber attack / hack on a bridge, who had also made an error in a recommendation to their client on their DVN setup. This is not a protocol hack of @aave and no crime insurance policy covering Aave would pay out for this. This is a credit default risk and protected by a Credit Default Swap. Where it gets confusing is that Aave's DAO appoints risk managers that are supposed to price the margins for collateral. However, you spin it though, the risk manager missed a credit event and the protocol remained resilient. What should ideally have happened is @aave have umbrella, collateral have Crime & E&O coverage and Bridge has Crime & E&O coverage. Insurers then get triggered by both collateral and bridge and then sue each other to decide who pays what %. There could be some argument that the risk manager might have some liability but it's going to be hard ground to justify because they have a framework, it's very public, they published their homework and we all deposited in a non-custodial fashion. << END EXAMPLE SIDE QUEST Getting back to the quant stuff. When you look at all the data of the 600 lending/borrowing protocols and 100+ hacks, especially on the larger protocols (of which there are nearly 20 hacks now) you notice something kind of interesting. The data suggests that the majority of protocols get pinged for a low proportion of their overall TVL. In fact the largest protocol hack was @eulerfinance and even that zero-day took about 63% There is a myth that is misunderstood, by even some brokers I discussed this with this morning, that hacks are total loss scenario. It might be for random off-the-book hedge funds but in the public and open-source Ethereum / Solana landscape we see all and it says the losses are varied but on average a small ratio. In fact you would cover 73% of all losses if you had just 5% of the TVL insured. Now hold up. If quotes in the market are around 1.5-4% and we can insure a large chunk with just 5% of cover then the passthrough to lenders is 1.5-4% / 20 per unit of TVL However, Increased Limits Factors kick in (honestly I don't even know if that's the correct acronym expansion, I just know it as "ILF") Insurers will generally insure blocks and create a "tower" which means that those at the bottom of the tower have higher risk. If the bottom of the tower is priced at 1% then the next guy might be happy to do next-loss cover at 90bps which implies an ILF of 90/100 = 90% On average ILF can vary but I think it's conservative to estimate around 95-99%. One of my broker buddies has also said there is a commercially minimum rate around 60bps so no matter how high the tower, you'll pay at least 60bps to get someone out of bed on each tower chunk. When you look at how this scales, on $1b of coverage you would buy actually just $50m of cover which would cover 73% of all losses. You would pay between 120.4bps and 325bps on that $50m You would pass through ONLY 5-19bps though to lenders. From a protocol perspective this is a total no brainer and insane that people don't do it more. The caveat? And why I care. "Unpermissioned DeFi is broadly uninsurable", a well known DeFi broker. Plug @KeyringNetwork... Lucky for you fuckers we charge no money on this and Keyring can onboard users with ZKPs in 3-30 seconds without selfies or passports. And most importantly, there is no backend review process, so you remain fully decentralised without triggering "points of control" for regulators. If you want to get insured, it's likely you'll want to look at putting a door lock on the think you insure to get a non ridiculous quote. Or get a quote at all.

Actionable analytic insight and globally integrated risk capital expertise, applied to decisions that protect and grow businesses across 120 countries. @AlexKrasnow, DeFi Lead at @Aon_plc, will take the stage at Vault Summit NYC. June 5, New York · nyc.vaultsummit.xyz

Unless I’ve mistaken this is a first-of-kind regulated insurance policy covering crime to such an extent in DeFi. It was a huge effort to get here with over 12 months of work from Teo Kithara-Bigot, Adam Wickens, Alex Krasnow and guest appearances from Christian Ogden-Davies. We feel this is the most robust regulated product out there in the market for DeFi lending markets and we hope this can provide foothold for more cover to grow as we expand.

Bitwise Onchain Solutions now has a website Staking & Vaults Check it out: onchain.bitwiseinvestments.c…

The most mentioned topics across our sessions in Cannes: RWA, @Morpho, MiCA, liquidity, and institutional adoption. The vocabulary of this market has changed.