Total value locked in crypto's lending protocols climbed 55 percent since early July, reaching $56 billion by Oct. 18, Gokhshtein Media's On-Chain Desk reported1. Lending markets had shed $11.33 billion in the second quarter alone, Galaxy Digital figures showed. Six months after the April 18 hack drained Aave's biggest market, money returned to the same corner of crypto.
Aave's total value locked falls $6.6 billion after the April 18 hack
Aave's total value locked before and after the Kelp DAO exploit, in billions of dollars
- After the hack: $19.8B
- Before the hack: $26.4B
Source: CoinDesk [3].
Read the chart as a table
| Item | Value |
|---|---|
| Before the hack | $26.4B |
| After the hack | $19.8B |
Read plainly, the number says lenders trust crypto lending again. Depositors watched Aave freeze whole markets in April. That reading skips one test. April's hack moved through wrapped tokens, bridges and oracles. Those same parts still sit under this recovery.
On April 18, attackers drained 116,500 rsETH, worth roughly $292 million, from Kelp DAO's cross-chain bridge, Chainalysis reported4. The bridge ran on one verifier network built by LayerZero Labs. Attackers broke into two of that network's own nodes. The attack also flooded its outside nodes with traffic. That forced the network to confirm a token burn missing from the blockchain's own record.
Chainalysis traced the attack to North Korea's Lazarus Group4. The stolen tokens landed on Aave as collateral. Aave held $26.4 billion at the time3. Its total value locked fell $6.6 billion within days, and it took on roughly $196 million in bad debt.
Stani Kulechov, founder and chief executive of Aave Labs, named the weakness plainly. “Traditional security reviews often overlooked risks within bridges, verifier networks, and other infrastructure components that an asset depends on,” Kulechov said1. He answered with a new framework built through the risk firm LlamaRisk. “Over the past several weeks, Aave has been developing a new risk framework that includes asset risk, bridging risk, chain risk, and advanced automation capabilities for risk management,” Kulechov said2. Assets that miss the new standard get removed from Aave over time.
Thomas Wu, chief financial officer at the lending platform Ledn, reads that fix differently. “Every wrap bridge and oracle between a lender and its underlying asset represents another point where a loan can fail,” Wu said1. His point holds across any number of reviews a protocol runs each quarter. A wrapped token still needs a bridge to mint it and an oracle to price it. Both sit outside the lending code Aave actually runs.
Aave also added new testing tools. Three AI tools scanned its code and raised 71 flags, TokenPost reported6. Reviewers called 20 of those real, each low or minor in severity. The other 51 were false alarms.
The harder question is who carries the risk when a wrapped token breaks. Vaults on protocols such as Morpho grew from roughly $300 million to $7 billion in deposits within a year, HOGE Wire reported5. Two of the biggest managers, Gauntlet and Steakhouse Financial, hold $1.88 billion and $1.26 billion of that pool.
Marc Zeller, founder of the Aave Chan Initiative, objects to the model. Managers compete on posted yield using deposits that belong to someone else, he has said5. Sid Powell, co-founder and chief executive of the lending firm Maple, takes a similar view. Lenders must treat a borrower's failure as possible at any time, he has said, and work back from that risk1.
Two curators manage $3.14 billion of DeFi lending's $7 billion in vaults, Aug. 26, 2026
Assets under management for curator groups on DeFi lending vaults, in billions of dollars
- The two named curator managers
- Other curators: $3.86B
Source: HOGE Wire [5].
Read the chart as a table
| Item | Value |
|---|---|
| Gauntlet | $1.88B |
| Steakhouse Financial | $1.26B |
| Other curators | $3.86B |
A curator earns a performance fee whether the vault's collateral holds or breaks. Depositors earn the advertised yield until the token depegs, then take the loss the way Aave's lenders did in April. Aave itself survived by freezing markets and removing assets from its list. The person who put capital into the vault holding the frozen asset came out of the freeze with less money than they put in.
The 55 percent recovery moved real money back into lending protocols. Aave's new framework targets the exact weakness Kelp DAO exposed, and its quarterly reviews now reach further than before. Curators still compete on yield with other people's money. Their own capital sits elsewhere.
Depositors carry the loss when a bridge or an oracle breaks again. The curators and protocols that collect fees along the way carry much less of it. Readers who want that next review early can get it from The Signal. The Signal is a free weekly email on crypto's people and its numbers. Sign up at cryptolately.com/newsletter, and ask who holds the risk before the yield looks too good.
Both sides, in their own words
Does that recovery prove depositors trust decentralized lending again?
“Over the past several weeks, Aave has been developing a new risk framework that includes asset risk, bridging risk, chain risk, and advanced automation capabilities for risk management”
“Every wrap bridge and oracle between a lender and its underlying asset represents another point where a loan can fail”
Sources
- The On-Chain Desk, "DeFi Lending TVL Climbs 55% to $56B as Protocols Tighten Asset Risk Reviews," Gokhshtein Media, Oct. 18, 2026, https://gokhshtein.com/news/2026-10-18-defi-lending-tvl-climbs-55-to-56b-as-protocols-tighten
- RT Watson, "New Aave risk framework proposed following KelpDAO exploit," The Block, June 9, 2026, https://www.theblock.co/post/404136/new-aave-risk-framework-proposed-following-kelpdao-exploit
- Shaurya Malwa, "Aave Records $6 Billion TVL Drop as Kelp Hack Exposes Structural Risk at DeFi Lender," CoinDesk, April 19, 2026, https://www.coindesk.com/tech/2026/04/19/aave-records-usd6-billion-tvl-drop-as-kelp-hack-exposes-structural-risk-at-defi-lender
- Chainalysis Team, "Inside the KelpDAO Bridge Exploit," Chainalysis, April 23, 2026, https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/
- Yuki Tanaka, "The Curator Reckoning: How DeFi Lending Broke in 2026," HOGE Wire, Aug. 26, 2026, https://hoge.gg/defi-lending-broke-2026-curator-reckoning/
- Simon Yoon, "Crypto Lending Contracts as External Risks Reach Beyond Smart Contracts," TokenPost, Oct. 8, 2026, https://www.tokenpost.com/news/technology/28114