The Su-35 flew into Ukrainian-controlled airspace for the first time in years, and got away clean. That single sentence, buried in a crypto news outlet, should have sent shivers through every DeFi protocol builder. Not because of geopolitics, but because of the pattern it reveals: a sophisticated actor identified a weakness in a layered defense system, executed a calibrated probe, and withdrew without triggering a response. The same pattern plays out in blockchain security every week, yet we keep designing our protocols as if the enemy will always announce their intentions.
I have spent the past decade in this industry, first as a PM at Zilliqa during the 2017 ICO boom, then leading product strategy for a lending protocol during DeFi Summer, and now as a decentralized protocol PM in Manila. I have seen code betray us because we betrayed our own principles. The Su-35 incident is not about military tactics; it is about the architecture of trust. And DeFi has a lot to learn from it.
Let me explain using the framework I have developed over years of auditing and building: Hook, Context, Core, Contrarian, Takeaway. This is how I write, and this is how I think.
Hook
The Su-35, a Russian 4++ generation fighter, entered airspace that Ukraine had controlled for years. It was not intercepted. It returned safely. The immediate interpretation was that Ukrainian air defenses had a gap. But the deeper truth is more uncomfortable: the Su-35’s penetration was a test of the entire kill chain—radar coverage, decision-making speed, rules of engagement, and ammunition availability. In DeFi, we call this a “sandwich attack” or a “flash loan exploit.” The attacker probes the system, finds a weakness in the economic game theory, and extracts value. The Su-35’s success is a mirror for every protocol that has ever been drained.
Context
The Su-35 is not a stealth aircraft. It is a 4++ generation fighter with thrust vectoring and a powerful radar, but it is designed to be detected. Its success in entering Ukrainian airspace depends on the defender’s inability to close the kill chain. Similarly, most DeFi exploits do not rely on sophisticated zero-day vulnerabilities. They rely on the defender’s inability to respond in time—a delayed oracle update, a misconfigured price feed, or a governance proposal that passes without scrutiny. The Su-35 event is a reminder that the attacker only needs one gap; the defender needs to close every gap.
In my 2020 whitepaper “The Illusion of Sovereignty,” I documented how the “code is law” ethos masked centralized oracle manipulations. The Su-35 penetration is a physical manifestation of the same illusion: the defender believes the system is impermeable, but the attacker has already mapped the edges.
Core
The core insight is that the Su-35’s penetration was not a random event. It was a calculated risk. The Russian military likely used intelligence to identify a window of vulnerability—perhaps a rotation of air defense systems, a shortage of interceptors, or a gap in radar coverage. In DeFi, the same logic applies. Every liquidity pool has a “window of vulnerability” when the price of an asset deviates from its true value due to a flash loan attack or a manipulated oracle. The Su-35’s “clean getaway” is analogous to the attacker’s profit extraction and withdrawal before the protocol can react.
Based on my experience auditing the Zilliqa mainnet launch in 2017, I learned that the most dangerous vulnerabilities are not the ones in the code, but the ones in the assumptions. The Zilliqa team had a race condition in the consensus layer because we assumed the network would never split. We were wrong. The Su-35 incident reveals that the Ukrainian military assumed the airspace was safe. They were wrong. In DeFi, we assume that economic incentives will prevent manipulation. We are often wrong.
The Su-35’s success also highlights the importance of “restrained deterrence.” The Russian military sent a high-value asset into hostile airspace but did not engage in a strike. It was a signal: “We can penetrate your defenses, but we choose not to escalate.” In DeFi, this is the equivalent of a white-hat hacker who exploits a vulnerability to demonstrate its existence, then returns the funds. But not all signals are benevolent. The Su-35’s flight could be a precursor to a larger offensive. Similarly, a protocol that experiences a minor exploit may be the testing ground for a larger attack.
I have seen this pattern repeatedly. In 2022, during the bear market, I helped design a grant program in the Polkadot ecosystem that prioritized foundational research. We funded a team that discovered a vulnerability in the XCM messaging protocol. They reported it privately. But the same vulnerability could have been used to drain multiple parachains. The Su-35 incident is a reminder that we must treat every probe as a potential prelude to a devastating attack.
Contrarian
The counter-intuitive angle is that the Su-35’s penetration might actually be good for Ukrainian defense in the long run. It reveals a weakness before it is exploited in a larger attack. The same logic applies to DeFi. A small exploit that exposes a gap in the defense system is preferable to a catastrophic attack that drains the entire protocol. The Su-35 event forces the Ukrainian military to reassess their air defense posture. In DeFi, a minor exploit forces the protocol team to revisit their assumptions.
But here is the blind spot: the Su-35’s penetration could also be a deliberate information operation. The article I read was published by a crypto news outlet, not a military source. The narrative of “Russian success” and “Ukrainian weakness” may be amplified to shape public opinion. In DeFi, we see the same phenomenon: FUD (fear, uncertainty, and doubt) about a protocol’s security can cause a bank run, even if the vulnerability is overstated. The Su-35 incident is a case study in how information warfare can undermine a system without a single shot being fired.
Code betrays when we do. The Su-35 penetrated Ukrainian airspace because the defenders had a gap. But the gap was not created by the attacker; it was created by the defenders’ own decisions—where to allocate resources, which systems to prioritize, how to train personnel. In DeFi, when a protocol is exploited, it is rarely because the code was inherently flawed. It is because the developers made trade-offs: speed over security, convenience over decentralization, growth over sustainability. Burnout is the tax on innovation. We push to launch, to attract liquidity, to hit milestones, and we leave gaping holes in our defenses.
Takeaway
The Su-35’s flight into Ukrainian airspace is a parable for DeFi. The next time you see a protocol suffer a small exploit, do not ignore it. It is a signal. The attacker is probing your kill chain. The question is not whether you will be penetrated, but whether you will learn from the penetration before it is too late. We must build systems that can detect and respond to probes, not just systems that assume they are impenetrable. The Su-35 got away clean this time. But the next time, it might not. And neither will your protocol.
The future of decentralized finance depends on our ability to internalize the lessons of military strategy: layered defenses, redundant systems, and the humility to accept that every system has a gap. The Su-35 principle is simple: the attacker will find the gap. Your job is to find it first.
