The recent $290 million exploit and the subsequent $13 billion drop in DeFi's total value locked have led many to proclaim the demise of decentralized finance. However, this narrative oversimplifies the complexities of the situation. The KelpDAO exploit, which was linked to North Korea's Lazarus Group, highlights the vulnerabilities of DeFi's infrastructure, particularly when protocols opt for single-verifier setups despite recommendations for more robust configurations.
The attack left rsETH, a liquid staking token, unbacked, sparking fears of bad debt spilling into lending markets. Nevertheless, the fact that DeFi has survived this ordeal is a testament to its resilience. The sharp decline in total value locked can be attributed to a repricing of risk rather than a catastrophic collapse.
Aave, the largest DeFi lending market, experienced significant outflows, but much of the TVL drop was due to the unwinding of leveraged positions, which had inflated TVL calculations. The actual net capital loss is likely a fraction of the headline figure. The yield environment had already become unattractive, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers.
This led to a buildup of leverage, which exacerbated the damage from the exploit. Crypto has faced worse setbacks, including the collapse of Terra, the Wormhole and Ronin hacks, and the Multichain bridge theft.
Yet, DeFi has consistently demonstrated its ability to recover. The repricing of trust will likely lead to higher risk premiums, but this does not necessarily mean the demise of DeFi.
Capital will rotate, and some deposits will return as conditions stabilize. The exploit serves as a wake-up call for builders to create safer systems while offering real-world use cases, rather than a death knell for DeFi.