The recent $290 million exploit and the subsequent $13 billion decline in DeFi's total value locked have led many to proclaim the demise of decentralized finance. However, this assessment may be premature.
The KelpDAO exploit, which appears to have originated from a targeted attack on LayerZero's verification stack, has been linked to North Korea's Lazarus Group. The incident highlights the importance of robust security measures, as Kelp had opted for a single-verifier setup despite recommendations to use a more resilient configuration. The exploit resulted in rsETH, a liquid staking token issued by KelpDAO, becoming unbacked, sparking fears of bad debt spilling into lending markets.
Nevertheless, the fact that DeFi has survived this incident is a testament to its resilience. The outflows from Aave, which totaled $8.45 billion over 48 hours, and the broader DeFi TVL decline, can be seen as a sharp repricing of risk rather than a catastrophic collapse.
Much of the TVL drop can be attributed to the unwinding of leveraged positions, which had inflated the TVL calculations. The actual net capital loss is likely a fraction of the headline figure. The yield environment, which had become unattractive, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers, had already stopped making sense. The risk premium that justified DeFi's complexity had largely disappeared, leading to a buildup of leverage, which exacerbated the damage caused by the exploit.
Crypto has survived worse incidents, including the collapse of Terra, the Wormhole and Ronin exploits, and the Multichain unraveling. The 'DeFi is dead' narrative is often wheeled out after every hack, but the recovery is slower and less dramatic.
The repricing of trust will have a lasting impact, with capital demanding more compensation for the risks associated with on-chain systems. However, this repricing is not the same as collapse. Some capital will return, and historically, deposit outflows during stress events reverse as conditions stabilize. There is evidence that capital is not leaving DeFi but rather rotating, with protocols like Spark experiencing an increase in TVL.
The more interesting critique is that DeFi has become too timid, offering low single-digit yields for users to bear infrastructure risk, smart contract risk, and governance risk. The Kelp exploit serves as a wake-up call for builders to create safer systems while continuing to offer real-world use cases.