The recent $290 million exploit and the subsequent $13 billion drop in DeFi's total value locked may seem catastrophic at first glance, but a more in-depth analysis suggests that the situation is not as dire as it appears. The KelpDAO exploit, which was attributed to North Korea's Lazarus Group, was a targeted attack on LayerZero's verification stack, rather than a smart contract bug. This incident highlights the importance of implementing more robust security measures, such as using multiple verifiers, to prevent similar attacks in the future. The exploit resulted in rsETH, a liquid staking token issued by KelpDAO, becoming unbacked, sparking concerns about potential bad debt and its impact on lending markets, particularly Aave's WETH pool.
However, the fact that DeFi has survived this incident and is still operational is a testament to its resilience. The sharp decline in DeFi's total value locked can be attributed to a repricing of risk, rather than a catastrophic failure of the ecosystem.
Aave, the largest DeFi lending market, experienced significant outflows, with $8.45 billion withdrawn over 48 hours, while the broader DeFi sector saw its total value locked drop to the mid-$80 billion range, similar to its level around the same time last year. This suggests that the decline was largely a result of a risk reassessment, rather than a complete loss of faith in DeFi. The actual net capital loss is likely to be a fraction of the headline figure, as much of the total value locked was comprised of recycled collateral and leverage. The yield environment had already become less favorable, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers.
This had led to a buildup of leverage, which exacerbated the impact of the exploit. The fact that crypto has survived worse incidents, such as the collapse of Terra, the Wormhole and Ronin hacks, and the Multichain bridge exploit, demonstrates that DeFi is capable of withstanding significant shocks.
The phrase 'DeFi is dead' is often used to describe the aftermath of such incidents, but it is misleading, as the recovery process is typically slower and less visible than the initial failure. The recent exploit is likely to lead to a repricing of trust, with capital demanding more compensation for the risks associated with on-chain systems. However, this does not necessarily mean that DeFi will collapse.
Instead, it may lead to a rotation of capital, with some deposits being withdrawn and redeposited later, as the cost of doing so is relatively low. The example of Spark, which delisted rsETH and other low-utilization assets in January, only to see its TVL jump from $1.8 billion to $2.9 billion over the weekend, demonstrates that capital is not simply leaving DeFi, but rather rotating to other platforms. The more interesting critique is that DeFi has become too timid, offering low single-digit yields for users to bear infrastructure risk, smart contract risk, and governance risk.
This suggests that builders need to focus on creating safer systems while continuing to offer real-world use cases, rather than simply trying to attract users with high yields. In conclusion, the recent exploit is not the end of DeFi, but rather a wake-up call for builders to improve the security and resilience of the ecosystem.