The recent $290 million exploit and the subsequent $13 billion drop in DeFi's total value locked have led many to proclaim the demise of decentralized finance. However, this narrative oversimplifies the situation. A more nuanced analysis reveals that DeFi has weathered the storm and continues to evolve. The KelpDAO exploit, which was linked to North Korea's Lazarus Group, was a targeted attack on infrastructure rather than a smart contract bug.
This distinction is crucial, as it highlights the complexities of DeFi's security landscape. The exploit's impact was exacerbated by Kelp's decision to use a single-verifier setup, despite recommendations to adopt a more resilient configuration.
The resulting damage to rsETH, a liquid staking token, triggered concerns about bad debt and its potential impact on lending markets, particularly Aave's WETH pool. Nevertheless, the fact that DeFi has survived this ordeal is a testament to its resilience. The rapid outflow of capital, with Aave experiencing $8.45 billion in outflows over 48 hours, was a sharp repricing of risk rather than a catastrophic collapse. A closer examination of the TVL drop reveals that a significant portion of the decline was due to the unwinding of leverage, rather than a direct result of the exploit.
The actual net capital loss is likely a fraction of the reported figure, although the exact amount is difficult to determine. The yield environment, which had become increasingly unattractive, contributed to the buildup of leverage in DeFi.
As of early April, Aave's APY on USDC deposits was lower than the yield available on idle cash at traditional financial institutions. This disparity led to a risk premium that had largely disappeared, making DeFi's complexity and smart contract exposure less justifiable. The subsequent leverage buildup, particularly in looping strategies, increased the concentration of risk and made the rsETH contagion more damaging. Crypto has faced worse challenges in the past, including the collapse of Terra, the Wormhole and Ronin hacks, and the Multichain unraveling.
Yet, DeFi has consistently demonstrated its ability to recover and adapt. The phrase 'DeFi is dead' is often invoked after high-profile hacks, but it overlooks the sector's capacity for resilience and growth. The recovery process may be slower and less dramatic than the initial failure, but it is a crucial aspect of DeFi's evolution. The recent exploit has led to a repricing of trust, with capital demanding more compensation for the risks associated with on-chain systems.
However, this repricing is not synonymous with collapse. Some capital will return to DeFi, while other funds will rotate to alternative protocols.
Spark, for example, has seen an increase in TVL, demonstrating that capital is not necessarily leaving DeFi but rather seeking more attractive opportunities. The more interesting critique of DeFi is not that it has failed but that it has become too timid. If the sector is to ask users to bear significant risks for low yields, it must provide more compelling products and use cases.
The KelpDAO exploit serves as a wake-up call for builders to create safer systems while continuing to offer real-world applications.