Crypto lending protocols have recovered 55 percent in total value locked since early July, reaching approximately $56 billion today—a rebound from Q2 outflows that followed the Kelp DAO exploit.
During the second quarter, $11.33 billion exited lending platforms, according to Galaxy figures. The Kelp DAO hack in April crystallized a blind spot: Aave's smart contracts were never breached, but hackers created 116,500 unbacked rsETH tokens worth roughly $290 million, then used them as collateral across Aave's markets. Aave deposits fell $15 billion in the aftermath, and the protocol froze rsETH and wrsETH markets.
The incident exposed what Aave Labs founder Stani Kulechov called a structural vulnerability. "Traditional security reviews often overlooked risks within bridges, verifier networks, and other infrastructure components that an asset depends on," Kulechov said. Aave has since broadened its security framework beyond its own smart contracts to assess the full dependency chain of each collateral asset, now conducting quarterly re-reviews.
Spark, another lending protocol, had already begun phasing out rsETH on SparkLend in January—months before the exploit. Chief executive Sam MacPherson said the move reflected a calculation that rsETH's minimal usage and revenue did not justify the added risk vector. Like Aave, Spark now evaluates governance design, operational security, liquidity management, and ecosystem dependencies alongside smart contract audits.
Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, framed the escalating risk in structural terms: "Every wrap bridge and oracle between a lender and its underlying asset represents another point where a loan can fail." Sid Powell, co-founder and chief executive of Maple, a crypto credit platform, said serious lenders must now assume borrower default is possible at any time, working backward from failure points to stress-test risk exposure.
