The recent $290 million exploit and the subsequent $13 billion drop in DeFi's total value locked may seem catastrophic at first glance, but a closer examination of the data paints a different picture. The exploit, which targeted KelpDAO's infrastructure, has been linked to North Korea's Lazarus Group and was facilitated by Kelp's decision to use a single-verifier setup despite recommendations to adopt a more secure configuration.
The incident left rsETH, a liquid staking token, unbacked and sparked concerns about potential bad debt in lending markets, particularly Aave's WETH pool. However, the more intriguing narrative is not the exploit itself, but rather DeFi's ability to withstand it. The sector experienced a sharp repricing of risk, with capital fleeing quickly after the breach. Aave alone saw $8.45 billion in outflows over 48 hours, while DeFi's total value locked fell to the mid-$80 billion range, roughly equivalent to its value around the same time last year.
This repricing, although significant, does not necessarily signify a destructive event. Aave had accumulated substantial rsETH as collateral in the weeks leading up to the exploit, and much of its ETH exposure was concentrated in looping strategies. These strategies, which involve depositing liquid restaking tokens, borrowing ETH against them, swapping for more restaking tokens, and repeating the process, can inflate total value locked calculations.
The actual net capital loss is likely a fraction of the reported $13 billion decline. The yield environment had already become less favorable, with Aave offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers. This disparity had largely disappeared, and leverage filled the gap, making the rsETH contagion more damaging.
Crypto has survived worse incidents, including the collapse of Terra, the Wormhole and Ronin exploits, and the Multichain unraveling. The phrase 'DeFi is dead' is often invoked after hacks, but the recovery is typically slower and less dramatic.
Bybit, for example, suffered a record-breaking $1.5 billion theft in February but continued operating and restored its reserves. The repricing of trust is a significant but not existential issue. 0xNGMI, founder of DefiLlama, believes that Aave has the resources to cover the loss, including its treasury and loans.
The biggest challenge will be the impact on risk premiums assigned to DeFi. Capital will demand more compensation for participating in on-chain systems with an extended attack surface.
Still, repricing is not the same as collapse. Some deposits will return as conditions stabilize, and there is evidence of capital rotation within DeFi, with Spark's TVL jumping from $1.8 billion to $2.9 billion over the weekend.
The more interesting critique is that DeFi has become too timid, offering low single-digit yields while asking users to bear infrastructure, smart contract, and governance risks. The Kelp exploit serves as a wake-up call for builders to create safer systems while providing real-world use cases.