Decentralized finance lending markets have climbed 55 percent since July, reaching approximately $56 billion in early October, according to Galaxy data tracking on-chain TVL across major protocols.
The rebound reverses a sharp Q2 contraction. In that quarter, the lending market shed $11.33 billion—a 16.78 percent decline—as confidence eroded following the Kelp DAO hack in April.
Hackers exploited a cross-chain vulnerability within Kelp DAO to mint 116,500 unbacked rsETH tokens valued at roughly $290 million. Those tokens were then posted as collateral on Aave to borrow other assets. While Aave's core smart contracts were never breached, the protocol saw deposits fall by approximately $15 billion in the immediate aftermath. Aave froze rsETH and wrsETH markets to prevent further contagion.
The Kelp incident exposed a gap in security practices: traditional audits focus on smart contract code but ignore the broader attack surface created by bridges, verifier networks, and wrapped assets. Stani Kulechov, founder and CEO of Aave Labs, said the protocol has rebuilt its security approach to account for external dependencies.
"Every wrap bridge and oracle between the lender and the underlying asset is another place a loan can go wrong," said Thomas Wu, CFO of Bitcoin-backed lender Ledn.
SparkLend, a lending market built on Spark, had already flagged this risk. CEO Sam MacPherson's team conducted a comprehensive review that weighed governance design, operational security, collateral quality, liquidity management and wider ecosystem dependencies. SparkLend removed rsETH in January—three months before the Kelp exploit—because its low usage and revenue did not justify the additional risk.
Aave has since adopted similar mechanisms, including quarterly re-reviews of every asset supported on its platform. Sid Powell, co-founder and CEO of Maple Finance, emphasized that sound lending requires assuming borrowers—and, by extension, collateral chains—can fail at any moment.
