Decentralized finance lending TVL has climbed to $56 billion, a 55 percent gain since July, reversing a challenging second quarter that saw the sector contract 16.78 percent and shed $11.33 billion in deposits, according to Galaxy data.
The Q2 decline stemmed largely from the April Kelp DAO hack. Attackers exploited a cross-chain route to mint 116,500 unbacked rsETH tokens—valued at roughly $290 million—and used them as collateral to borrow assets on Aave markets. Although Aave's smart contracts remained intact, the protocol lost approximately $15 billion in deposits in the days after the exploit. Aave froze its rsETH and wrsETH markets to contain further exposure.
The incident exposed a fundamental gap in DeFi security models. Stani Kulechov, founder and CEO of Aave Labs, said Aave has rebuilt its security approach to address interlinked protocol risks—acknowledging that smart contract audits alone are insufficient. Traditional reviews often miss risks embedded in bridges, verifier networks, and other infrastructure that wrapped assets depend on. These external dependencies create vectors for cascading failures across interconnected protocols.
Thomas Wu, CFO of Bitcoin-backed lender Ledn, emphasized that every wrap bridge, and oracle between a lender and its underlying asset introduces a failure point.
Spark moved preemptively. The protocol began phasing out rsETH on SparkLend in January—months before the Kelp exploit—after determining that rsETH's low usage and revenue did not justify the additional risk. Sam MacPherson, Spark's CEO, detailed the protocol's security review process, which extends beyond smart contracts to governance design, operational security, collateral quality, liquidity management, and ecosystem dependencies. Aave has adopted similar mechanisms, conducting quarterly re-reviews of every supported asset.
Sid Powell, co-founder and CEO of crypto credit platform Maple, said serious lenders must assume any borrower can fail at any time. This principle structures risk management strategies, working backward from potential failure scenarios.
