The recent $290 million exploit and subsequent $13 billion drop in DeFi's total value locked may seem catastrophic at first glance, but a closer examination of the data reveals a more complex narrative. The KelpDAO exploit, which targeted the infrastructure used in LayerZero's verification stack, has been linked to North Korea's Lazarus Group and highlights the importance of robust configuration settings. While the incident has sparked fears of bad debt and liquidity crises, particularly in Aave's WETH pool, it also underscores DeFi's ability to withstand significant shocks. The sharp repricing of risk that followed the breach, with $8.45 billion in outflows from Aave alone, was not entirely unexpected, given the sector's history of volatility.
Aave's significant accumulation of rsETH as collateral in the weeks leading up to the exploit, largely due to leveraged positions, contributed to the TVL drop. However, the actual net capital loss is likely a fraction of the headline figure, as the calculation of TVL is often inflated by looping strategies. These strategies, which involve depositing liquid restaking tokens, borrowing ETH against them, and repeating the process, can artificially inflate TVL and create an uneven playing field.
The yield environment, which had already become less favorable, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers, further exacerbated the issue. The risk premium that once justified DeFi's complexity and smart contract exposure had largely disappeared, leading to a reliance on leverage to fill the gap.
The subsequent unwind of these strategies has been sharp, but the data from DefiLlama shows that reETH balances on Aave had grown rapidly in the weeks leading up to the exploit, reaching nearly 580,000 tokens ($1.3 billion). Crypto has survived worse incidents, including the collapse of Terra, the Wormhole and Ronin hacks, and the Multichain unraveling. The phrase 'DeFi is dead' is often used after high-profile hacks, but the recovery process is typically slower and less dramatic.
Aave's ability to operate and process withdrawals, despite the significant losses, is a testament to the sector's resilience. The repricing of trust and risk premiums will likely have a lasting impact, but it is not a death knell for DeFi. As 0xNGMI, founder of DefiLlama, noted, the losses are significant but unlikely to be existential, and Aave has many resources to cover the loss, including its treasury and taking loans. The biggest issue will be the impact on risk premiums assigned to DeFi, which will likely lead to a more cautious approach from investors.
However, this repricing is not the same as collapse, and some deposits will return as conditions stabilize. There is also evidence of capital rotation within DeFi, with Spark's TVL jumping from $1.8 billion to $2.9 billion over the weekend.
The more interesting critique is that DeFi has become too timid, offering low single-digit yields for users to bear infrastructure risk, smart contract risk, and governance risk. The KelpDAO exploit serves as a wake-up call for builders to create safer systems while continuing to offer real-world use cases.