The recent $290 million exploit and the subsequent $13 billion decline in DeFi's total value locked may seem catastrophic at first glance, but a closer examination of the data paints a different picture. The KelpDAO exploit, which was attributed to North Korea's Lazarus Group, was a targeted attack on LayerZero's verification stack, rather than a smart contract bug. This incident highlights the importance of implementing more secure configurations, as LayerZero had previously recommended. The exploit left rsETH, a liquid staking token issued by KelpDAO, unbacked, triggering concerns about potential bad debt in lending markets, particularly Aave's WETH pool.
However, the story of DeFi's resilience is more intriguing than the exploit itself. The rapid outflow of capital, with Aave experiencing $8.45 billion in outflows over 48 hours, and the broader DeFi TVL dropping to the mid-$80 billion range, can be seen as a sharp repricing of risk rather than a destructive event. A significant portion of the TVL decline can be attributed to the unwinding of leveraged positions, as users had built up significant exposure to rsETH in the weeks leading up to the exploit.
The actual net capital loss is likely a fraction of the reported $13 billion, due to the complex nature of DeFi's TVL calculations. The yield environment had already become unattractive, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers. This led to a buildup of leverage, which exacerbated the damage caused by the rsETH contagion. Historical context is essential in understanding DeFi's ability to withstand significant setbacks.
The sector has survived worse incidents, such as the collapse of Terra, the Wormhole and Ronin hacks, and the Multichain bridge exploit. More recently, Bybit suffered a record-breaking $1.5 billion theft, yet continued operating and restored reserves. The repricing of trust in DeFi is a significant consequence of the exploit, with capital demanding more compensation for the increased risk.
However, this repricing is not equivalent to collapse, and some deposits are likely to return as conditions stabilize. There is evidence of capital rotation within DeFi, with Spark's TVL jumping from $1.8 billion to $2.9 billion over the weekend. The exploit serves as a wake-up call for DeFi builders to create safer systems while continuing to offer real-world use cases, rather than a death knell for the sector.