The recent $290 million exploit and $13 billion slide in DeFi's total value locked may seem catastrophic at first glance, but a closer examination of the data reveals a different narrative. The KelpDAO exploit, which targeted LayerZero's verification stack, has been linked to North Korea's Lazarus Group and was facilitated by Kelp's decision to use a single-verifier setup despite recommendations to the contrary.
The resulting unbacked rsETH and potential bad debt in lending markets, particularly Aave's WETH pool, triggered a sharp repricing of risk, with $8.45 billion in outflows from Aave alone over 48 hours. However, this decline is more indicative of a risk reassessment rather than a destructive event. The actual net capital loss is likely a fraction of the reported $13 billion, as much of the total value locked was already recycled collateral. The yield environment, which had become unattractive, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers, had led to a buildup of leverage, making the subsequent unwind more severe.
Crypto has survived worse incidents, including Terra's collapse, Wormhole and Ronin's losses, and Multichain's unraveling. The 'DeFi is dead' phrase is often invoked after hacks, but the recovery, although slower, is less visible. Bybit's $1.5 billion theft, for instance, did not halt its operations. The losses are significant, but unlikely to be existential, with Aave having recourses to cover the loss, including its treasury and loans.
The repricing of trust will lead to increased risk premiums, but this is not the same as collapse. Capital will rotate, and some deposits will return as conditions stabilize.
The more interesting critique is that DeFi has become too timid, offering low single-digit yields for significant infrastructure risk. The Kelp exploit serves as a wake-up call for builders to create safer systems while providing real-world use cases.