Crypto lending total value locked climbed 55 percent since July, reaching $56 billion. The rebound reverses a $11.33 billion outflow during the second quarter, when confidence faltered following the April Kelp DAO hack.
During that exploit, hackers minted 116,500 unbacked rsETH tokens valued at roughly $290 million by exploiting Kelp DAO's cross-chain bridge. Many tokens were posted as collateral on Aave's lending markets. Although Aave's smart contracts remained intact, the protocol saw deposits fall $15 billion in days. Aave froze rsETH and wrsETH markets to contain contagion.
Stani Kulechov, founder and chief executive of Aave Labs, said cascading risks through interlinked protocols are now a primary security focus. "Traditional security reviews overlooked risks in bridges, verifier networks and external infrastructure that assets depend on," he said. Aave has introduced a quarterly review process for every listed asset.
Other lending protocols are expanding their risk frameworks. Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, noted that every wrap bridge and oracle between a lender and underlying asset represents an additional failure point. Sid Powell, co-founder and chief executive of Maple, said serious lenders must assume borrowers can fail at any time.
Sam MacPherson, chief executive of Spark, said the protocol reviews governance design, operational security, collateral quality, liquidity management and ecosystem dependencies beyond smart contract audits. Spark phased out rsETH on SparkLend in January, months before the Kelp exploit, after determining rsETH's low usage and revenue did not justify the additional risk.
