Crypto lending TVL has recovered to $56 billion, a 55 percent jump since July, reversing a second quarter that saw $11.33 billion flee the sector, according to Galaxy data.
The Q2 contraction of 16.78 percent centered on the April Kelp DAO exploit, which undermined confidence across on-chain lending. Hackers minted 116,500 unbacked rsETH tokens via Kelp's cross-chain infrastructure—valued at roughly $290 million—and posted them as collateral on Aave markets. Though Aave's smart contracts remained intact, the protocol absorbed a $15 billion deposit outflow and froze rsETH and wrsETH markets.
The incident exposed a structural vulnerability: collateral quality depends not just on protocol security but on every bridge, wrap and oracle in the asset's chain of custody. Stani Kulechov, founder and CEO of Aave Labs, said security "can't stop at the smart contract." Traditional audits, he noted, often "missed the risk sitting in the bridges, verifier networks and other infrastructure an asset depends on."
Thomas Wu, CFO of Bitcoin-backed lender Ledn, reinforced the point: "Every wrap bridge and oracle between the lender and the underlying asset is another place a loan can go wrong."
Protocols are adapting. Spark phased out rsETH support on SparkLend in January—ahead of the April exploit—after determining its low usage and revenue didn't justify additional risk. CEO Sam MacPherson said the team now reviews governance design, operational security, collateral quality, liquidity management and ecosystem dependencies as standard.
Aave introduced quarterly asset re-reviews. Sid Powell, co-founder and CEO of Maple, emphasized that lenders must assume counterparty failure and stress-test accordingly.
