Crypto lending TVL has climbed 55 percent since July, reaching approximately $56 billion, reversing a second-quarter contraction that saw $11.33 billion exit the sector, according to Galaxy data.
The downturn was triggered partly by the April Kelp DAO exploit, which allowed hackers to mint 116,500 unbacked rsETH tokens valued at roughly $290 million and use them as collateral on Aave. Though Aave's smart contracts remained intact, deposits fell by around $15 billion in the aftermath. The protocol froze rsETH and wrsETH markets to contain contagion.
The incident exposed a vulnerability that protocols are now systematizing their defenses against: risk cascading through interconnected infrastructure. Stani Kulechov, founder and CEO of Aave Labs, said the protocol has rebuilt its security framework beyond traditional smart contract audits to assess risks embedded in bridges, verifier networks, and foundational assets.
Spark, a competing lending platform, began phasing out rsETH on SparkLend in January—months before the Kelp exploit—based on collateral quality and ecosystem dependency reviews. Chief executive Sam MacPherson noted that Spark's security assessment spans governance design, operational security, collateral quality, liquidity management, and broader protocol dependencies.
Thomas Wu, CFO of Bitcoin-backed lender Ledn, framed the problem directly: each wrap bridge, and oracle connecting a lender to its underlying asset represents a failure point. Sid Powell, co-founder and CEO of Maple, said serious lenders must assume any borrower can default and design systems accordingly.
Aave now conducts quarterly re-reviews of every supported asset, adapting its risk model to the evolving threat landscape as interconnectivity deepens.
