Decentralized finance lending markets have recovered 55 percent in total value locked since July, reaching approximately $56 billion today, reversing a sharp Q2 contraction.
Galaxy data shows $11.33 billion exited the sector during Q2, a 16.78 percent quarterly decline largely triggered by fallout from the Kelp DAO hack in April. That exploit—which minted 116,500 unbacked rsETH tokens valued at roughly $290 million—exposed systemic risk across interconnected protocols. The attacker deposited the fraudulent tokens as collateral on Aave, forcing the protocol to freeze rsETH and wrsETH markets despite its core smart contracts remaining unbreached. Aave deposits fell approximately $15 billion in the days after the exploit.
Stani Kulechov, founder and chief executive of Aave Labs, said the protocol has rebuilt its security approach beyond smart contract audits. "Security measures can't stop at the smart contract," Kulechov said. "Traditional reviews often missed the risk sitting in the bridges, verifier networks and other infrastructure an asset depends on." Aave now conducts quarterly re-reviews of every supported asset to account for these broader dependencies.
Spark adopted similar measures. Sam MacPherson, chief executive of Spark, said the protocol now assesses governance design, operational security, collateral quality, liquidity management and ecosystem dependencies—not just contract code. Spark phased out rsETH from SparkLend in January, before the April exploit, citing the asset's "low usage and revenue" as insufficient to justify the risk.
Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, said every wrap bridge and oracle between a lender and underlying asset creates an additional attack vector. Sid Powell, co-founder and chief executive of Maple, advised that "serious lenders" must operate under the assumption that a borrower can fail at any time, requiring resilience built into lending models from inception.
The renewed focus on holistic security reflects the growing threat of AI-assisted exploits and cascading failures across linked protocols. The TVL recovery signals renewed user confidence, though protocols continue hardening defenses against an evolving attack surface.
