Crypto lending total value locked has increased 55 percent since July, reaching $56 billion. This follows a 16.78 percent contraction in Q2, when $11.33 billion exited the sector after the Kelp DAO hack in April.
During that breach, hackers exploited a Kelp DAO cross-chain route to mint 116,500 unbacked rsETH tokens worth approximately $290 million. The tokens were deposited as collateral on Aave, forcing the protocol to freeze rsETH and wrsETH markets and triggering a $15 billion deposit outflow.
Aave's smart contracts were not directly breached, but the incident exposed a critical gap: traditional audits miss risks in bridges, verifier networks and asset infrastructure. Stani Kulechov, founder and CEO of Aave Labs, said the protocol rebuilt its security approach to account for this wider attack surface.
Other lenders are moving similarly. Spark began phasing out rsETH on SparkLend in January, before the Kelp exploit, citing low usage and revenue relative to the additional risk. Sam MacPherson, CEO of Spark, said the protocol now conducts quarterly asset re-reviews that extend beyond smart contracts to governance design, operational security, collateral quality and ecosystem dependencies.
Thomas Wu, CFO of Bitcoin-backed lender Ledn, noted that each wrap bridge and oracle adds a failure point. Sid Powell, co-founder and CEO of credit platform Maple, said serious lenders must plan for borrower failures and systemic exploits, including those potentially assisted by artificial intelligence.
Aave has since introduced similar quarterly mechanisms for every asset on its platform.
