Crypto lending markets have surged 55 percent since early July, with total value locked now reaching approximately $56 billion, reversing a sharp contraction from the second quarter.
The sector shed $11.33 billion in Q2 as TVL fell 16.78 percent, largely triggered by confidence loss after the April Kelp DAO cross-chain exploit. That breach resulted in the creation of 116,500 unbacked rsETH tokens valued at roughly $290 million at the time.
Many unbacked rsETH tokens were posted as collateral on Aave markets. Although Aave's smart contracts remained secure, the protocol suffered substantial deposit outflows—approximately $15 billion in the days after the exploit—and was forced to freeze its rsETH and wrsETH markets.
"Security efforts can't stop at the smart contract," Aave founder and CEO Stani Kulechov said. "Traditional reviews often missed the risk sitting in the bridges, verifier networks and other infrastructure an asset depends on." Kulechov said Aave "rebuilt our approach around that wider view."
Thomas Wu, CFO of Bitcoin-backed lender Ledn, framed the expanded attack surface plainly: "Every wrap bridge and oracle between the lender and the underlying asset is another place a loan can go wrong."
Sid Powell, co-founder and CEO of crypto credit platform Maple, said serious lenders must assume a borrower can fail at any time and build security frameworks accordingly.
DeFi lender Spark implemented comprehensive security reviews extending beyond smart contract audits. Chief executive Sam MacPherson confirmed the team now assesses governance design, operational security, collateral quality, liquidity management and ecosystem dependencies.
Spark had already begun phasing out rsETH on SparkLend in January, before the April Kelp exploit. An internal assessment determined rsETH's "low usage and revenue" did not justify the additional risk.
Aave introduced quarterly re-reviews of every supported asset, reflecting an industry-wide shift toward comprehensive risk management in DeFi lending.
