In April, the losses caused by attacks in the cryptocurrency industry exceeded $600 million. The two events with the greatest impact, Drift Protocol and Kelp DAO, resulted in losses of nearly $300 million each. Kelp's situation is particularly noteworthy. Currently, public analysis shows that the attacker did not directly breach the smart contract, but bypassed the cross chain message verification process. Subsequently, the stolen rsETH was deposited into Aave as collateral, lending out real ETH and further transmitting the risk into the entire DeFi liquidity system. Afterwards, the market began to hedge and withdraw funds, and @ aave also joined forces with multiple protocols to launch the "DeFi United" rescue plan. Currently, the fundraising has reached the target. Ultimately, there are never true 'bystanders' on the chain. At the same time as this incident, AI is pushing both the offensive and defensive sides of security issues into a new era. There have been many discussions about Claude Mythos recently. Although some capability descriptions still lack sufficient independent verification, the trend is clear: in the future, both vulnerability discovery and attack generation will become increasingly automated. AI is simultaneously strengthening attackers and defenders. But ultimately, it is a war between the parties involved, the auditors, and the infrastructure team. For ordinary users, what is worth rethinking is actually another thing: What is the pricing for the profits we have received? Many times, we naturally understand aging as an opportunity. But now I increasingly feel that many returns are essentially just another expression of risk. The difference between 5% and 20% often does not mean 'higher efficiency', but rather that you are taking on greater uncertainty for the system. The most dangerous part of DeFi is precisely here, as most of its risks are tail risks. Usually low-frequency, silent, and almost imperceptible, it is easy to be ignored or even assumed to be non-existent. But the characteristic of tail risk is that it is not charged by frequency, it is settled by intensity. It may have been stable for two years, but in the end, it all went to zero within a day. And every percentage point accumulated in those two years was actually pricing the risk for that day. Before playing DeFi, first think about how much loss you can afford, and then deduce whether it's worth taking a risk for this yield.