Crypto lending rises again… but have they solved the risks?

As the charts flip from red to green, crypto lending has seen a resurgence of interest after a particularly dismal second quarter.

Figures from Galaxy show that $11.33 billion left the sector in Q2 — partly due to the crisis of confidence in lenders caused by the Kelp DAO hack in April that left users of the most trusted protocol, Aave, unable to access their ETH.

Since the beginning of July, however, total lending value locked has gained more than 55% to sit around $56 billion today.

But that also means the honeypot has grown larger. Can users trust interlinked DeFi lending protocols in the age of AI-assisted hacks, when an exploit from any one protocol can have a series of devastating effects for other protocols connected to it?

Stani Kulechov, founder and chief executive of Aave Labs, tells Magazine the problem is now top of mind.

“When a protocol accepts a token as collateral, it is also accepting that token’s bridge, its verifier configuration, its oracle and its issuer’s operational security.”

And that’s exactly what landed Aave in trouble.

An expanding attack surface

When hackers exploited a Kelp DAO cross-chain route in April, they created 116,500 unbacked rsETH (worth about $290 million at the time), and many of those tokens were posted as collateral to borrow other assets on Aave markets.

Even though Aave’s own contracts were not breached, the protocol still saw deposits fall by around $15 billion in the days after the exploit, and it had to freeze its rsETH and wrsETH markets.

The lending market contracted by 16.78% in Q2. Source: Galaxy

Kulechov says that Aave now takes a more holistic approach to security.

“We rebuilt our approach around that wider view,” he says. “Our starting point is that security can’t stop at the smart contract.” He adds that traditional reviews “missed the risk sitting in the bridges, verifier networks and other infrastructure an asset depends on.”

Related: MiCA is coming for DeFi vaults, but regulation will be difficult

Users of lending protocols will similarly need to judge how exposed a protocol is to external and internal risks.

“Every wrapper, bridge and oracle between the lender and the underlying asset is another place a loan can go wrong,” says Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn.

Sid Powell, co-founder and chief executive of crypto credit platform Maple, tells Magazine that “serious lenders” should assume a borrower can fail at any time and work backward from there.

“What am I holding, where is it, can I see it in real time, and how quickly can I get to it if something breaks?”

When security fails, containment matters