Crypto lending total value locked has increased 55 percent since July, reaching approximately $56 billion. This follows a 16.78 percent contraction in Q2, when $11.33 billion in capital flowed out of the sector, according to Galaxy data.
The April Kelp DAO exploit created 116,500 unbacked rsETH tokens—valued at roughly $290 million at the time—by targeting Kelp's cross-chain messaging. Many of these tokens were subsequently used as collateral on Aave markets. While Aave's smart contracts remained intact, the protocol saw a $15 billion deposit outflow and was forced to freeze rsETH and wrsETH markets.
Stani Kulechov, founder and CEO of Aave Labs, said the exploit exposed security blind spots. "Security must extend beyond smart contracts," Kulechov said. "Traditional audits often overlook risks in bridges, verifier networks and other external infrastructure an asset relies on."
Thomas Wu, CFO of Bitcoin-backed lender Ledn, framed the problem mechanically: Each wrap bridge and oracle between a lender and its underlying asset introduces a failure point. Sid Powell, co-founder and CEO of credit platform Maple, said serious lenders must operate with the assumption that any borrower can fail at any time.
Sam MacPherson, CEO of DeFi lender Spark, outlined a multi-layer security review process covering governance design, operational security, collateral quality, liquidity management and ecosystem dependencies. Spark began phasing out rsETH on SparkLend in January—three months before the Kelp exploit—after determining the asset's low usage and revenue did not justify the risk.
Aave has implemented quarterly re-reviews for every asset, Kulechov said.
