Crypto lending total value locked has climbed to $56 billion, marking a 55 percent increase since July, after a dismal second quarter saw $11.33 billion in outflows driven by the Kelp DAO hack in April.
The Kelp exploit created 116,500 unbacked rsETH tokens—worth approximately $290 million at the time—by leveraging a cross-chain route. Many compromised rsETH were posted as collateral on Aave, breaching no Aave smart contract but exposing the protocol to downstream liability. Aave deposits fell by around $15 billion in the days following the incident, and the broader lending market contracted 16.78 percent in Q2 according to Galaxy data.
Stani Kulechov, founder and chief executive of Aave Labs, said security cannot stop at the smart contract level. Traditional audits, he noted, miss risks embedded in bridges, verifier networks and infrastructure dependencies. Aave has rebuilt its security approach to include quarterly asset reviews and pre-emptive collateral assessments.
Spark, the Aave-backed lending protocol, began phasing out rsETH on SparkLend in January—before the exploit—after assessing that rsETH's low usage and revenue did not justify the risk. Sam MacPherson, chief executive of Spark, said his team now evaluates governance design, operational security, collateral quality, liquidity management and ecosystem dependencies alongside smart contract audits.
Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, said every wrap bridge and oracle between the lender and underlying asset introduces another potential point of failure. Sid Powell, co-founder and chief executive of credit platform Maple, advised serious lenders to assume borrower failure and plan backward from that premise.
