Crypto lending has rebounded sharply, with total value locked climbing 55 percent since early July to roughly $56 billion—a $20 billion swing from Q2's contraction, when the sector shed $11.33 billion as user confidence eroded.
The April Kelp DAO exploit crystallized the interconnection risk that now dominates protocol security strategy. Hackers minted 116,500 unbacked rsETH tokens—worth $290 million at the time—by exploiting a Kelp cross-chain route. Those tokens then circulated as collateral across Aave markets, forcing the protocol to freeze rsETH and wrsETH pairs despite Aave's own contracts remaining intact. Aave deposits fell roughly $15 billion in the days following.
Stani Kulechov, founder and CEO of Aave Labs, said the industry has moved beyond smart contract audits alone. "Traditional security reviews often overlooked risks inherent in bridges, verifier networks and other infrastructure an asset relies on," Kulechov said. "We've rebuilt our strategy to address those broader dependencies."
Thomas Wu, CFO of Bitcoin-backed lender Ledn, framed the expanded attack surface plainly: every wrap bridge and oracle between a lender and underlying asset introduces another failure point. Sid Powell, co-founder and CEO of Maple, urged serious lenders to assume borrower failure at any time.
Spark proactively delisted rsETH from SparkLend in January—three months before the Kelp breach—based on an assessment that rsETH's minimal usage and revenue did not justify the additional risk. Sam MacPherson, Spark's CEO, said his team now reviews governance design, operational security, collateral quality, liquidity management and ecosystem dependencies as a routine.
Aave has institutionalized the same discipline. The protocol now re-reviews all supported assets quarterly, reflecting an industry-wide shift toward continuous and comprehensive risk assessment rather than point-in-time audits.
