Crypto lending total value locked has surged 55 percent since July, reaching approximately $56 billion. The rebound reverses a steep contraction in Q2, when Galaxy data shows $11.33 billion exited the sector—a 16.78 percent decline triggered largely by the Kelp DAO hack in April.
The exploit targeted a cross-chain route within Kelp DAO, creating 116,500 unbacked rsETH tokens valued at roughly $290 million. Those tokens were then posted as collateral to borrow assets on Aave. While Aave's smart contracts escaped breach, the protocol shed around $15 billion in deposits in the days after the incident and was forced to freeze rsETH and wrsETH markets.
The cascade underscored a critical vulnerability in interconnected DeFi: a flaw in one protocol can trigger cascading liquidations and capital flight across the ecosystem, particularly as AI-assisted attack vectors mature.
Stani Kulechov, founder and chief executive of Aave Labs, said security reviews have shifted beyond smart contract audits. "Previous security reviews often overlooked risks inherent in critical external infrastructure, such as bridges, verifier networks, and other dependencies an asset relies on," he said. "This wider view is now central to our security strategy."
Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, framed the exposure plainly: "Every wrap bridge and oracle between the lender and the underlying asset is another place a loan can go wrong."
Sid Powell, co-founder and chief executive of Maple, said serious lenders must "operate under the assumption that a borrower can fail at any point and build their risk management backward from that premise."
Spark Finance has institutionalized this discipline. Chief executive Sam MacPherson said his team conducts comprehensive reviews spanning smart contracts, governance design, operational security, collateral quality, liquidity management, and ecosystem dependencies. Spark began phasing out rsETH in January—three months before the Kelp exploit—after determining its "low usage and revenue" did not justify the additional risk.
Aave has adopted similar rigor. Kulechov confirmed that every supported asset undergoes quarterly re-review to catch evolving risks before they metastasize across lending markets.
