Total value locked in decentralized finance lending protocols has risen 55 percent since July, reaching approximately $56 billion. This rebound follows a $11.33 billion capital outflow in the second quarter, driven primarily by the Kelp DAO hack in April.
The Kelp DAO exploit involved hackers minting 116,500 unbacked rsETH tokens worth roughly $290 million at the time, then posting them as collateral on Aave via a compromised cross-chain route. While Aave's smart contracts remained secure, the protocol experienced a $15 billion deposit withdrawal in the days following the incident. Aave froze its rsETH and wrsETH markets to contain risk.
Stani Kulechov, founder and CEO of Aave Labs, said the core issue is interconnected protocol security. "Aave has rebuilt its security approach to encompass a wider view, acknowledging that traditional smart contract reviews missed risks in bridges, verifier networks and other asset infrastructure," Kulechov said.
The DeFi lending market contracted 16.78 percent in Q2, underscoring the need for security frameworks beyond individual audits. Thomas Wu, CFO of Bitcoin-backed lender Ledn, said every wrap bridge and oracle between a lender and underlying asset introduces another potential point of failure.
Sid Powell, co-founder and CEO of Maple, emphasized proactive risk management. Serious lenders must assume a borrower can default at any time and design systems accordingly, Powell said.
Sam MacPherson, CEO of Spark, detailed a comprehensive security review process that extends beyond smart contracts to governance design, operational security, collateral quality, liquidity management and ecosystem dependencies. Spark began phasing out rsETH on SparkLend in January, before the Kelp exploit, after determining the asset's low usage and revenue did not justify its additional risk.
Kulechov confirmed Aave now re-reviews every supported asset quarterly to identify and mitigate risks from external dependencies and interlinked protocols.
