In the wake of a $290 million exploit and a $13 billion drop in DeFi's total value locked, it's easy to conclude that decentralized finance is on the brink of collapse. However, this perspective overlooks the complexity of the situation. The KelpDAO exploit, which appears to have originated from a targeted attack on LayerZero's verification stack, has been linked to North Korea's Lazarus Group. Notably, the exploit was facilitated by Kelp's decision to use a single-verifier setup, despite recommendations to adopt a more resilient configuration.
The consequences of the exploit were far-reaching, with rsETH, a liquid staking token issued by KelpDAO, becoming unbacked and sparking fears of bad debt in lending markets, particularly Aave's WETH pool. Nevertheless, the fact that DeFi has endured is a testament to its resilience. The rapid outflow of capital, with Aave experiencing $8.45 billion in outflows over 48 hours, and the broader DeFi TVL declining to the mid-$80 billion range, can be seen as a sharp repricing of risk rather than a catastrophic collapse.
It's essential to consider that a significant portion of the TVL drop was likely due to recycled collateral, and the actual net capital loss may be a fraction of the reported figure. The yield environment, which had become increasingly unattractive, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers, had already stopped making sense. The risk premium that historically justified DeFi's complexity and smart contract exposure had largely disappeared, leading to a reliance on leverage to fill the gap.
The subsequent unwind of these strategies exacerbated the damage caused by the rsETH contagion. Historical context is also important, as crypto has survived worse incidents, including the collapse of Terra, the Wormhole and Ronin exploits, and the Multichain unraveling. The phrase 'DeFi is dead' is often invoked after every hack, but the recovery is typically slower and less dramatic. The repricing of trust and the impact on risk premiums will be significant, but it's unlikely to be existential.
As 0xNGMI, founder of DefiLlama, noted, 'Aave has many recourses to cover the loss, including its treasury and taking loans, and I think those will have to be used to protect the protocol.' The biggest issue will be the impact on risk premiums assigned to DeFi. However, repricing is not the same as collapse, and some of the money will return as conditions stabilize. There is also evidence of capital rotation, with Spark's TVL jumping from $1.8 billion to $2.9 billion over the weekend.
The more interesting critique is that DeFi has become too timid, and if the sector is going to ask users to bear infrastructure risk, smart contract risk, and governance risk for low single-digit yields, the product set starts to look less compelling. Ultimately, the Kelp exploit serves as a wake-up call for builders to create safer systems while continuing to offer real-world use cases.