The recent $290 million exploit and the subsequent $13 billion drop in DeFi's total value locked may seem catastrophic at first glance, but a closer examination of the data reveals a more complex narrative. The exploit, which targeted KelpDAO's infrastructure, has been linked to North Korea's Lazarus Group and was facilitated by Kelp's decision to use a single-verifier setup despite recommendations to adopt a more secure configuration. This incident has triggered concerns about the potential for bad debt to spread to lending markets, particularly Aave's WETH pool.
However, a more intriguing story emerges when considering the fact that DeFi has endured despite this significant setback. The rapid outflow of capital, with Aave experiencing $8.45 billion in outflows over 48 hours, can be seen as a sharp repricing of risk rather than a catastrophic collapse.
It is essential to note that the $292 million theft did not directly cause the $13 billion decline, as a substantial portion of the total value locked was already recycled collateral. The actual net capital loss is likely a fraction of the headline figure, although it is challenging to determine the exact amount due to the complex embedding of looping strategies in DeFi's TVL calculations. These strategies, which involve depositing liquid restaking tokens, borrowing ETH against them, swapping for more restaking tokens, and repeating the process, can inflate TVL on the way up and unwind sharply during events like this. The yield environment, which had already stopped making sense, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers, had led to a buildup of leverage.
This concentration of leverage is what made the rsETH contagion so damaging. The phrase 'DeFi is dead' is often used after every hack, but the reality is that crypto has survived worse incidents, such as the collapse of Terra, the Wormhole and Ronin exploits, and the Multichain bridge theft. The recovery from these events may be slower and less dramatic, but it is a testament to the resilience of the DeFi ecosystem. The repricing of trust and the impact on risk premiums are significant, but they do not necessarily signal the collapse of DeFi.
Instead, they may lead to a rotation of capital, as evidenced by Spark's TVL jumping from $1.8 billion to $2.9 billion over the weekend. The more interesting critique is that DeFi has become too timid, offering low single-digit yields while asking users to bear infrastructure risk, smart contract risk, and governance risk. This wake-up call for builders to create safer systems while continuing to offer real-world use cases may ultimately lead to a more robust and resilient DeFi ecosystem.