The recent $290 million exploit and subsequent $13 billion slide in DeFi's total value locked may seem catastrophic at first glance, but a more in-depth analysis suggests that the situation is not as dire as it appears. The KelpDAO exploit, which was attributed to North Korea's Lazarus Group, was a targeted attack on LayerZero's verification stack, rather than a smart contract bug. This incident highlights the importance of robust infrastructure and the need for decentralized finance protocols to prioritize security.
The exploit led to a significant decline in DeFi's total value locked, with Aave alone experiencing $8.45 billion in outflows over 48 hours. However, this decline can be seen as a repricing of risk rather than a collapse of the entire sector. The actual net capital loss is likely a fraction of the reported $13 billion, as much of the total value locked was already recycled collateral. The yield environment had also become less favorable, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers.
This led to a buildup of leverage, which exacerbated the damage caused by the exploit. Despite these challenges, decentralized finance has survived worse incidents, including the collapse of Terra and the theft of billions of dollars from Wormhole and Ronin. The sector is likely to recover from this incident, with capital rotating to other protocols such as Spark, which has seen its total value locked jump from $1.8 billion to $2.9 billion.
The exploit serves as a wake-up call for builders to focus on creating safer systems while continuing to offer real-world use cases. As 0xNGMI, founder of DefiLlama, noted, the losses are significant but unlikely to be existential, and the biggest issue will be the impact on risk premiums assigned to DeFi. While some deposits may not return, historically, deposit outflows during stress events have reversed as conditions stabilize.