The recent $290 million exploit and the subsequent $13 billion decline in DeFi's total value locked have led many to proclaim the demise of decentralized finance. However, this perspective may be overly simplistic. The KelpDAO exploit, which was attributed to North Korea's Lazarus Group, was a result of a targeted attack on infrastructure used in LayerZero's verification stack, rather than a smart contract bug.

This incident has significant implications for the DeFi sector, but it does not necessarily signal its downfall. In fact, the data suggests that DeFi is still intact, albeit with a repriced risk premium. The outflows from Aave, the largest DeFi lending market, were substantial, with $8.45 billion in outflows over 48 hours.

Nevertheless, this decline can be seen as a sharp repricing of risk rather than a catastrophic collapse. Much of the TVL drop can be attributed to the unwinding of leverage, which had been built up in the weeks leading up to the exploit.

The actual net capital loss is likely a fraction of the headline figure. The yield environment had already become unfavorable, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers.

This had led to a buildup of leverage, which made the subsequent unwind more damaging. Crypto has survived worse incidents, including the collapse of Terra, the Wormhole and Ronin hacks, and the Multichain bridge theft.

The phrase 'DeFi is dead' is often wheeled out after every hack, but the recovery is typically slower and less dramatic. The recent exploit has led to a repricing of trust, with capital demanding more compensation for the risks associated with on-chain systems.

However, this does not mean that DeFi is collapsing. Some of the money will return, and capital is not simply leaving DeFi but rotating to other platforms. Spark, for example, has seen its TVL jump from $1.8 billion to $2.9 billion, demonstrating clear capital rotation. The more interesting critique is that DeFi has become too timid, with low single-digit yields failing to justify the infrastructure risk, smart contract risk, and governance risk.

The KelpDAO exploit is not the end of DeFi but a wake-up call for builders to create safer systems while continuing to offer real-world use cases.