Crypto lending surges 55% but new risks emerge

Lending rebounds after a brutal spring

Crypto lending has grown more than 55% since July, with total value now locked in lending protocols around $56 billion, according to figures from DeFiLlama. That is a sharp turnaround from the second quarter, when about $11.33 billion fled the sector.

The exodus followed the Kelp DAO hack in April, which shook confidence across the industry. Even though Aave's own smart contracts were not breached, the protocol saw deposits fall by roughly $15 billion and had to freeze its rsETH and wrsETH markets after hackers used the exploit to flood the system with unbacked tokens that were then posted as collateral.

What lenders say about risk

• Kelp DAO created about 116,500 unbacked rsETH worth roughly $290 million at the time of the exploit.
• Aave has started an orderly wind-down on six networks that did not meet its updated chain-level standards.
• Spark began phasing out rsETH on SparkLend in January, before the April hack, due to low usage and added risk.
• AI testing caught 271 of 304 injected vulnerabilities in Aave's V4 contracts through mutation testing.
• About 70% of AI-generated findings in a recent Aave security review were false positives, according to founder Stani Kulechov.

Security goes beyond smart contracts

Kulechov says the industry is learning that security cannot stop at the contract level. When a lending protocol accepts a token as collateral, it is also accepting the risk from that token's bridge, verifier, oracle, and issuer.

Thomas Wu, chief financial officer at Bitcoin-backed lender Ledn, said every wrapper, bridge, and oracle between the lender and the underlying asset is another place a loan can go wrong. Shawn Owen, founder and chief executive of SALT Lending, pointed to human error as one of the biggest vulnerabilities. He said key management failures, access control mistakes, and social engineering have caused major losses, and smart contract audits do not catch those issues.

Containment plans matter

Sam MacPherson, chief executive of DeFi lender Spark, said protocols also need procedures for when things go wrong. "Preventing losses is only part of the challenge," he said. "Protocols also need to demonstrate how a loss would be contained if something does go wrong."

Ledn keeps client Bitcoin with qualified custodians instead of lending it out for additional yield. Wu said keeping the number of transactions low reduces the chance of a breach.

Yield pressure can loosen standards

Sid Powell, co-founder and chief executive of Maple, warned that when deposits come in faster than managers can find good loans, the pressure to maintain yields can lead to risky choices. Collateral standards can get looser, and managers may lend to borrowers they would have turned down in normal times. Powell said the managers who survive downturns are usually the ones willing to say no to capital.

AI: helper or new attack surface?

Aave is already using AI-assisted testing alongside its conventional security processes. Kulechov noted that AI is fast and broad, but expert judgment remains essential because most AI findings are not valid.

He also warned that AI itself introduces new risks. As AI agents start managing capital onchain, their permissions, inputs, and decision logic become things that need to be secured just like a contract.

Why this matters for crypto users

The rebound in lending shows demand is back, but the sector is still grappling with the fallout from last spring's hack. Users are being urged to look beyond smart contract audits and examine how exposed a protocol is to bridges, oracles, custody practices, and the broader ecosystem it depends on.

What comes next

Aave says it will review every asset quarterly and again after any material change. Spark continues to phase out assets it judges to carry disproportionate risk relative to their revenue.

Sources

• Cointelegraph