Total value locked in crypto lending protocols has climbed 55 percent since July, reaching $56 billion. The rebound reverses a sharp Q2 contraction: lending markets dropped 16.78 percent during the second quarter, with $11.33 billion exiting the sector, according to Galaxy data.
The exodus followed the Kelp DAO hack in April, which minted 116,500 unbacked rsETH tokens valued at roughly $290 million by exploiting a cross-chain route. Many of these tokens were used as collateral on Aave, forcing the protocol to freeze rsETH and wrsETH markets despite no direct breach of Aave's smart contracts. Aave saw deposits fall $15 billion in the days after the incident.
The exploit exposed a structural problem: risks nested in bridges, oracle networks and token wrappers cascade into lending platforms even when the core protocol is secure. Stani Kulechov, founder and CEO of Aave Labs, said that traditional audits missed these dependencies and that Aave has rebuilt its security review around a wider ecosystem lens. Aave now re-reviews every asset quarterly.
Spark, which had already phased out rsETH on SparkLend ahead of the April hack, has adopted a similar approach. CEO Sam MacPherson said Spark evaluates governance design, operational security, collateral quality, liquidity management and ecosystem dependencies alongside smart contract audits.
Thomas Wu, CFO of Bitcoin-backed lender Ledn, framed the issue in concrete terms: every wrap bridge and oracle between a lender and underlying asset is a potential failure point. Sid Powell, co-founder and CEO of Maple, added that lenders should assume any borrower can fail at any time, underscoring the need for ecosystem-wide due diligence rather than siloed risk assessment.
