Decentralized finance lending platforms have seen total value locked (TVL) increase by more than 55 percent since July, reaching approximately $56 billion today. The sector contracted by 16.78 percent in Q2, when $11.33 billion exited following the April Kelp DAO hack, according to Galaxy figures.
During the April incident, hackers exploited a Kelp DAO cross-chain route to mint 116,500 unbacked rsETH tokens valued at approximately $290 million. The tokens were deposited as collateral on Aave markets to borrow other assets. Though Aave's smart contracts remained uncompromised, the protocol experienced an outflow of roughly $15 billion in the days following the exploit and froze its rsETH and wrapped rsETH (wrsETH) markets.
The incident exposed cascading risks in interlinked protocols. Stani Kulechov, Aave founder and chief executive, said the protocol rebuilt its risk framework to account for vulnerabilities in bridges, verifier networks and other external infrastructure that an asset depends on. Aave now conducts quarterly re-reviews of every supported asset.
Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, noted that every wrap bridge and oracle between a lender and the underlying asset introduces an additional failure point. Sid Powell, co-founder and chief executive of Maple, said serious lenders should operate under the assumption that a borrower can fail at any time and design systems accordingly.
Spark phased out rsETH on its SparkLend platform starting in January—before the April Kelp exploit—after assessing that the asset's low usage and minimal revenue generation did not justify the additional risk. Sam MacPherson, chief executive of Spark, said the platform's security reviews now extend beyond smart contracts to include governance design, operational security, collateral quality, liquidity management and ecosystem dependencies.
