DeFi Development Corp.

RISK MANAGEMENT AND STRATEGY

We maintain cybersecurity risk management processes designed to identify, assess and manage material risks from cybersecurity threats to our information systems, digital assets and business operations guided by the ISO/IEC 27001 information security management systems standard. We periodically evaluate and update our security measures as appropriate. We also consult with external parties on our risk management and strategy.

Our cybersecurity risk management processes are integrated into our broader enterprise risk management framework, which is intended to address risks associated with private key management, validator operations and network participation, smart contracts, staking, trading, customer information and risks arising from our reliance on external service providers.

The Company’s cybersecurity risk management processes include, among other things:

•the use of external institutional digital asset custodians for the storage of substantially all of our digital assets, rather than self-custody;

•contractual arrangements with custodians that include security, compliance and reporting obligations;

•internal policies and procedures governing access controls, authentication, and segregation of duties for systems that interface with digital assets or financial reporting;

•monitoring of cybersecurity developments and threat environments relevant to digital asset markets and financial systems, and

•monitoring of validator uptime, network activity, and system performance to identify anomalies or potential threats

We also have a vendor risk assessment process which includes, but is not limited to, due diligence, contractual provisions and ongoing oversight, where appropriate. However, we do not control cybersecurity practices of external parties, and any failure or breach of such external parties could adversely affect us.

Despite these efforts, cybersecurity risks cannot be eliminated, and our processes may not be effective in preventing or detecting all cybersecurity incidents.

Refer to “Item 1A. Risk factors” in this Annual Report for additional information about cybersecurity-related risks.

GOVERNANCE

Our Board of Directors considers cybersecurity risk as part of its broader risk oversight function and has delegated oversight to the Audit Committee of the Board. The Audit Committee reviews management’s implementation of our cybersecurity risk program and receives, at least annually, a report from management on our cybersecurity risks. Management will also update the Audit Committee, as needed, regarding any cybersecurity incidents.

We do not maintain a designation function or role with the primary responsibility for cybersecurity risk. Instead, it is a shared responsibility across our entire management team. Management is responsible for implementing and executing our information security strategy and structure, including securing digital assets held on our validators and those held at external custodians and exchanges, securing customer data and monitoring owned and managed validator activity. Management’s day-to-day responsibilities include, among others, the

17

identification, monitoring and management of cybersecurity risks of our information systems, digital asset custodians and our real estate product platforms. Management also consults with external consultants, as needed, with experience and expertise in cybersecurity risk management strategies, execution and operations with operational technology security and cybersecurity incident response.

CYBERSECURITY INCIDENTS

In 2025 and 2024, there were no material cybersecurity incidents on or conducted through our information systems and, as of the date of this Annual Report, we are not aware of any cybersecurity risks that are reasonably likely to materially affect our business.