The recent $290 million exploit and the subsequent $13 billion decline in DeFi's total value locked have led many to proclaim the demise of decentralized finance. However, this narrative oversimplifies the situation.
The attack on KelpDAO's infrastructure, attributed to North Korea's Lazarus Group, was a sophisticated one, exploiting a single-verifier setup that Kelp had opted for despite recommendations to use a more robust configuration. The resulting unbacking of rsETH, a liquid staking token, triggered fears of a potential debt crisis in lending markets, particularly Aave's WETH pool.
Nevertheless, the fact that DeFi has survived this ordeal is a testament to its resilience. The sharp outflows from Aave, totaling $8.45 billion over 48 hours, and the broader DeFi TVL decline to the mid-$80 billion range, merely represent a repricing of risk rather than a catastrophic collapse. Much of the TVL drop can be attributed to the unwinding of leveraged positions, particularly looping strategies that had become prevalent in the weeks leading up to the exploit.
These strategies, which involved depositing liquid restaking tokens, borrowing ETH, and repeating the process, had inflated TVL on the way up and were always vulnerable to a sharp correction. The actual net capital loss is likely a fraction of the headline figure, although the exact amount is difficult to determine due to the complexity of DeFi's TVL calculations. The yield environment had already become unfavorable, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers. This had led to a buildup of leverage, which exacerbated the damage caused by the exploit.
Crypto has weathered worse storms, including the collapse of Terra, the Wormhole and Ronin hacks, and the Multichain bridge theft. The 'DeFi is dead' narrative is often trotted out after every hack, but the recovery is typically slower and less dramatic. 0xNGMI, founder of DefiLlama, believes that the losses are significant but not existential, and that Aave has the resources to cover the loss. The biggest issue will be the impact on risk premiums assigned to DeFi, which will likely increase.
However, repricing is not the same as collapse, and some of the money will return as conditions stabilize. There is evidence that capital is rotating within DeFi, rather than leaving the space entirely.
Spark's TVL, for example, jumped from $1.8 billion to $2.9 billion over the weekend, demonstrating clear capital rotation. The more interesting critique is that DeFi has become too timid, offering low single-digit yields for users who bear significant infrastructure, smart contract, and governance risks.
The Kelp exploit serves as a wake-up call for builders to create safer systems while continuing to offer real-world use cases.