The recent $290 million exploit and the subsequent $13 billion drop in DeFi's total value locked have led many to declare that decentralized finance is broken. However, this assessment may be overly simplistic.
The KelpDAO exploit, which was attributed to North Korea's Lazarus Group, was a targeted attack on LayerZero's verification stack. The incident highlighted the importance of robust security measures, as Kelp had opted for a single-verifier setup despite warnings to use a more resistant configuration. The exploit left rsETH, a liquid staking token, unbacked and sparked fears of bad debt spilling into lending markets. Nevertheless, the fact that DeFi has survived this incident is a testament to its resilience.
The sharp decline in DeFi's total value locked can be attributed to a repricing of risk rather than a catastrophic failure. Aave, the largest DeFi lending market, experienced significant outflows, but much of the TVL drop was due to the unwinding of leveraged positions.
The actual net capital loss is likely a fraction of the headline figure. The yield environment had already become unfavorable, with Aave offering lower returns than traditional financial institutions.
The risk premium that justified DeFi's complexity had largely disappeared, leading to a buildup of leverage that exacerbated the damage from the exploit. Crypto has survived worse incidents, including the collapse of Terra and the loss of billions in liquidations and losses.
The phrase 'DeFi is dead' is often invoked after high-profile hacks, but the recovery is slower and less dramatic. The recent exploit has led to a repricing of trust, with capital demanding more compensation for the risks associated with on-chain systems. However, this repricing is not the same as collapse, and some capital will return as conditions stabilize.
There is evidence of capital rotation within DeFi, with some protocols experiencing increased activity. The more interesting critique is that DeFi has become too timid, offering low single-digit yields for significant infrastructure and smart contract risks. The Kelp exploit serves as a wake-up call for builders to create safer systems while continuing to offer real-world use cases.