Crypto lending TVL surged 55 percent since early July to $56 billion, reversing a second-quarter exodus that drained $11.33 billion from the sector in a 16.78 percent contraction.
The April Kelp DAO exploit accelerated the outflow. Hackers minted 116,500 unbacked rsETH tokens worth roughly $290 million through a cross-chain vulnerability, then posted those tokens as collateral on Aave to borrow other assets. Though Aave's smart contracts remained intact, the incident triggered a $15 billion deposit withdrawal. Aave froze rsETH and wrsETH markets to contain spillover risk.
The incident exposed a blind spot in traditional protocol security reviews. Stani Kulechov, founder and CEO of Aave Labs, said the protocol has rebuilt its strategy around a wider security perimeter that extends beyond smart contracts to bridges, verifier networks, and other infrastructure. "Security cannot stop at the smart contract level," Kulechov said.
Thomas Wu, CFO of Bitcoin-backed lender Ledn, noted that every wrap bridge, and oracle between a lender and underlying asset adds a failure vector. Sid Powell, co-founder and CEO of Maple, advised serious lenders to assume any borrower can fail and stress-test accordingly.
Spark proactively phased out rsETH from SparkLend in January—before the April exploit—after determining its low usage and revenue did not justify the additional risk. Spark CEO Sam MacPherson said his team reviews governance design, operational security, collateral quality, liquidity management, and broader ecosystem dependencies alongside contract audits.
Aave now re-audits every supported asset quarterly. The approach reflects a shift toward holistic risk frameworks that account for cascading failures across interlinked protocols and infrastructure layers.
