The recent $290 million exploit and the subsequent $13 billion decline in DeFi's total value locked have led some to proclaim the demise of decentralized finance. However, this assessment may be premature and overly simplistic. A closer examination of the data reveals that the situation is more nuanced. The KelpDAO exploit, which was attributed to North Korea's Lazarus Group, was a targeted attack on LayerZero's verification stack, rather than a smart contract bug.
This distinction is crucial, as it highlights the complexities and challenges associated with DeFi's infrastructure. The exploit resulted in rsETH, a liquid staking token issued by KelpDAO, becoming unbacked, triggering concerns about potential bad debt and its impact on lending markets, particularly Aave's WETH pool. Nevertheless, the fact that DeFi has survived this incident is a testament to its resilience.
The sharp outflows of capital, with Aave experiencing $8.45 billion in outflows over 48 hours, can be seen as a repricing of risk rather than a catastrophic collapse. The TVL drop, which brought the sector back to levels similar to those seen around the same time last year, was partly due to the unwinding of leverage and recycled collateral. The actual net capital loss is likely a fraction of the reported figure, although the exact amount is difficult to determine due to the complexities of DeFi's TVL calculations.
The yield environment, which had become less favorable, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers, had already stopped making sense. The risk premium that historically justified DeFi's complexity and smart contract exposure had largely disappeared, leading to a buildup of leverage that exacerbated the impact of the exploit.
The phrase 'DeFi is dead' is often invoked after every hack, but the reality is that the sector has survived worse incidents, including the collapse of Terra, the Wormhole and Ronin hacks, and the unraveling of Multichain. The recovery may be slower and less dramatic, but it is underway. The repricing of trust and the impact on risk premiums will be significant, but it is not a fatal blow.
Capital will demand more compensation for sitting in on-chain systems, but this does not necessarily mean the end of DeFi. In fact, some capital is rotating within the sector, with Spark's TVL jumping from $1.8 billion to $2.9 billion over the weekend, demonstrating that users are seeking alternative options. The more interesting critique is that DeFi has become too timid, offering low single-digit yields for users to bear infrastructure risk, smart contract risk, and governance risk.
This wake-up call for builders to create safer systems while continuing to offer real-world use cases may ultimately lead to a more robust and resilient DeFi ecosystem.