BIS: Crypto Firms Take on Bank-Like Risks After DeFi Hacks

The Bank for International Settlements published a paper warning that a class of firms it calls multifunction cryptoasset intermediaries (MCIs) are taking on credit, liquidity and maturity transformation risks by accepting customer cryptoassets and redeploying them into lending, market making and other activities.

MCIs include platforms that run investment programs using customer assets to fund loans or provide market liquidity. The BIS noted those activities resemble functions performed by banks and prime brokers but often occur without deposit insurance or access to central bank liquidity in many jurisdictions, and flagged significant opacity and data gaps about these firms.

The paper recommended a two-track regulatory approach that combines entity-based and activity-based rules. It identified several practical challenges for supervisors, including gaps in coverage for on-chain borrowing and lending, the need for cross-border supervisory cooperation, and limited supervisory resources that complicate consistent oversight of MCIs.

The warning follows large decentralized finance exploits this month. Attackers exploited a verification flaw at KelpDAO to mint about 116,500 rsETH and used those tokens as collateral to borrow Ether from major lending platforms, including Aave. When rsETH collapsed in value, lenders were left with unsecured exposures and protocols suspended operations; roughly $292 million was drained in that incident.

Separately, the Drift protocol lost about $285 million in an exploit. Combined, the DeFi losses this month total about $577 million, nearly four times the losses recorded in the first quarter.

Security firms and blockchain investigators linked the KelpDAO theft to a group of interest to Western authorities and reported attackers converted nearly all of roughly 75,700 ETH into bitcoin within about 36 hours. Much of the swapping flowed through THORChain and generated about $910,000 in fees for that platform.

The BIS paper flagged the growing integration between traditional finance and crypto markets as a potential source of spillovers. It called for better data, clearer coverage of crypto lending and borrowing, stronger international cooperation, new reporting standards, liquidity backstops for certain operations and mechanisms for cross-border supervision.

The paper also identified common DeFi vulnerabilities, including smart-contract and protocol design flaws, hidden counterparty exposures and opaque pledging of customer assets. Those weaknesses left lenders exposed when tokens used as collateral lost value and complicated recovery and enforcement when stolen assets were moved across chains.