Crypto lending has recovered sharply since the end of the second quarter, but the rebound is bringing renewed scrutiny of the risks that connect decentralized-finance protocols. Total lending value locked has risen by more than 55% since the beginning of July to about $56 billion, according to figures cited by Cointelegraph. The recovery follows a $11.33 billion contraction in the sector during the second quarter, when confidence was damaged by an exploit involving Kelp DAO and the resulting disruption at Aave.
A larger market, and a wider attack surface
The April incident showed why a lending protocol can be affected even when its own smart contracts are not directly breached. Hackers exploited a Kelp DAO cross-chain route and created 116,500 unbacked rsETH tokens, valued at approximately $290 million at the time. Many of those tokens were then used as collateral to borrow other assets on Aave markets.
Aave subsequently saw deposits decline by around $15 billion in the days after the exploit and froze its rsETH and wrsETH markets. The episode contributed to a 16.78% contraction in the lending market during the second quarter.
Stani Kulechov, founder and chief executive of Aave Labs, said the event illustrated that accepting a token as collateral also creates exposure to the token’s bridge, verifier configuration, oracle and issuer’s operational security. In other words, a protocol’s risk does not end with an audit of its own code.
Thomas Wu, chief financial officer of Bitcoin-backed lender Ledn, described each wrapper, bridge and oracle between a lender and an underlying asset as another potential failure point. Sid Powell, co-founder and chief executive of crypto credit platform Maple, said lenders should be able to identify what they hold, where it is held, whether it can be monitored in real time and how quickly it could be accessed if a disruption occurs.
The concern is particularly relevant as the value held in lending protocols grows again. A larger pool of assets can make protocols more attractive targets, while links between platforms may allow an exploit in one part of the ecosystem to affect other applications.
Containment is as important as prevention
DeFi lending teams are responding by broadening their reviews beyond smart-contract vulnerabilities. Spark chief executive Sam MacPherson said his company examines governance, operational security, collateral quality, liquidity management and dependencies across the wider ecosystem.
Spark began phasing out rsETH on SparkLend in January, before the Kelp exploit, after concluding that the asset’s low usage and revenue did not justify the additional risk created by supporting it. Aave, meanwhile, says assets are re-reviewed quarterly and after any material change. Kulechov also said the protocol has begun an orderly wind-down on six networks that did not meet its chain-level standards.
These measures reflect a wider principle: protocols cannot control every part of the ecosystem, but they can decide how much external risk to accept and how quickly to limit its impact. MacPherson said preventing losses is only part of the task; platforms also need to show how a loss would be contained if prevention fails.
Human error and pressure to generate yield
Technical vulnerabilities are not the only concern. Shawn Owen, founder and chief executive of SALT Lending, said key management, access controls and social engineering have contributed to major losses and would not necessarily be identified by a smart-contract audit.
Risk can also increase when lenders move customer assets into other strategies to generate interest. The failures of Celsius, Voyager and BlockFi during the 2022 market downturn demonstrated the consequences of taking on risks that customers did not understand or expect.
Ledn keeps client Bitcoin with qualified custodians instead of lending it out to generate additional yield. Wu said fewer transactions and segregated custody can reduce the number of points at which a breach may occur.
Maple’s Powell also warned that rapid deposit growth can create pressure to maintain yields. If managers cannot find enough suitable lending opportunities, they may loosen collateral standards or lend to borrowers they would previously have rejected. He said managers that endure downturns are generally those willing to reject capital when they do not have an appropriate place to deploy it.
AI offers testing benefits but creates new questions
Artificial intelligence is becoming part of the security process as well as part of the threat landscape. Aave has used AI-assisted testing alongside conventional reviews, including mutation testing that deliberately inserted bugs into its V4 contracts. Its test suites detected 271 of 304 injected vulnerabilities.
In a review of Aave’s V3 and V4 codebases, three AI security tools produced 71 findings. After manual review, 20 were judged valid, while 51 were not. Kulechov said AI provides breadth and speed, but that expert judgment remains necessary because roughly 70% of the initial findings were false positives.
AI may therefore help identify weaknesses without replacing human specialists. At the same time, AI agents that manage capital onchain could introduce another layer of exposure. Their permissions, inputs and decision-making logic would need protection in much the same way as smart contracts.
Moneyiar market picture
Moneyiar data at 21:43-21:44 on October 8, 2026, showed mixed but mostly weaker performance among selected crypto assets:
- Solana (SOL): $110.1125260869, down 4.75% over 24 hours and 6.32% over seven days.
- Chainlink (LINK): $12.6906415185, down 4.49% over 24 hours and 10.88% over seven days.
- Safe (SAFE): $0.1082020939, up 0.42% over 24 hours and down 0.02% over seven days.
- Propy (PRO): $0.3366552189, down 3.71% over 24 hours and 6.69% over seven days.
The renewed activity in crypto lending has not removed the sector’s underlying challenge: securing not only individual contracts, but also the bridges, oracles, custodians, governance systems and other infrastructure connected to them. As lending value expands, the ability to monitor and contain failures will remain central to how protocols manage risk.
