DeFi lending TVL has climbed 55 percent since July, reaching approximately $56 billion, according to Galaxy data. The rebound follows a 16.78 percent Q2 contraction that saw $11.33 billion in capital outflows, triggered partly by the April Kelp DAO exploit.
The hack demonstrated a critical vulnerability in the lending ecosystem's architecture. Attackers exploited a cross-chain route within Kelp DAO to mint 116,500 unbacked rsETH tokens worth roughly $290 million. These tokens were then posted as collateral on Aave to borrow other assets.
Aave's smart contracts remained secure, but the protocol shed approximately $15 billion in deposits in the days following the incident. Aave froze rsETH and wrsETH markets in response.
"Security cannot terminate at the smart contract level," Aave founder and CEO Stani Kulechov said. He noted that traditional audits often overlook risks embedded in bridges, verifier networks, and other infrastructure layers upon which an asset depends.
Thomas Wu, CFO of Bitcoin-backed lender Ledn, framed the problem concretely: "Every wrap bridge, and oracle situated between a lender and the underlying asset represents a potential point of failure for a loan."
Aave has since implemented quarterly re-reviews of every supported asset, scrutinizing governance design, operational security, collateral quality, and ecosystem dependencies alongside code audits. Kulechov confirmed the protocol adopted this expanded framework.
Spark moved faster. The lending protocol had already removed rsETH from SparkLend in January, before the Kelp exploit. "rsETH's low usage and revenue did not justify the additional risk," Spark CEO Sam MacPherson said. SparkLend's risk review process now extends across the same dimensions Aave identified—governance, operational security, liquidity management, and protocol interconnections.
Sid Powell, co-founder and CEO of crypto credit platform Maple, emphasized the operational discipline required. "Serious lenders should operate under the assumption that a borrower can fail at any given time and structure their operations accordingly," Powell said.
