Crypto lending market rebounds-focus shifts to risk control

加密借贷市场触底反弹，行业焦点转向风险控制

经历了第二季度信心崩塌的阵痛后，加密借贷市场正在强劲复苏。Galaxy引用的数据显示，由于4月Kelp DAO遭黑客攻击导致Aave用户无法访问其ETH资产，2026年第二季度该领域的锁定总价值（TVL）减少了113.3亿美元。然而，自7月初以来，借贷TVL已飙升超过55%，据DeFiLlama数据，目前约为560亿美元。这一复苏令人欣慰，但也向投资者和开发者提出了一个更尖锐的问题：随着借贷基础设施日益互联，当一个被利用的组件损害其他组件时，协议如何控制损失？

核心要点

• Galaxy估计，受4月影响Aave用户的Kelp DAO事件波及，2026年第二季度加密借贷TVL下降了113.3亿美元。
• 从7月初开始，借贷TVL上涨超过55%至约560亿美元，显示出对链上信贷需求的回暖。
• Aave创始人Stani Kulechov认为，现代借贷安全不能仅止步于智能合约审计，因为桥接器、验证者、预言机和发行商引入了额外的风险。
• 受访高管强调“遏制”的重要性：如果流程和依赖关系设计不当，仅仅防止损失是不够的，必须限制爆炸半径。
• Although AI-assisted testing is being used in lending security workflows, experts warn that it still relies heavily on human judgment due to false positives and new attack surfaces.

From contraction in the second quarter to rebound in July

Galaxy research cited in the report frames the second quarter of 2026 as a period of accelerated contraction in crypto lending. Part of the $11.33 billion outflow was related to the April Kelp DAO hack that prevented users of Aave's most trusted protocol from accessing their ETH. The incident not only put pressure on a set of contracts, but also exposed how collateral behavior can create ripple effects in the interconnected system. With TVL lending now back to around $56 billion-about 55% higher than at the end of the second quarter (based on DeFiLlama data)-the industry's rebound suggests market participants are willing to re-engage. The question, however, is whether lenders and liquidity providers can manage the "attack surface" expanded by interdependence.

Kelp DAO incident highlights dependency risks

According to previous reports, hackers took advantage of a cross-chain route of Kelp DAO in April. The incident generated 116,500 unsupported rsETH tokens (valued at approximately $290 million at the time), many of which were used as collateral to lend assets in different markets on the Aave Market. Although Aave's own contract was not directly breached, the agreement suffered a major blow. Deposits reportedly fell by about $15 billion in the days after the explosion, and in response Aave froze its rsETH and wrsETH markets.

Stani Kulechov, CEO and founder of Aave Labs, described how the problem transcends the code level. He believes that when a protocol accepts a token as collateral, it is actually accepting the token's broader infrastructure-including its bridges, validator configurations, oracle dependencies and the issuer's operational security. This perspective is crucial to users because it changes the meaning of "security" in DeFi lending. Lenders no longer view the risk of agreements as limited to their smart contracts, but increasingly assess them based on the reliability of the entire chain of dependence that transfers value from one system to another.

Containment, Governance and Operational Preparation

In interviews cited in the article, several lending executives emphasized that strong processes are as important as vulnerability prevention. Thomas Wu, chief financial officer of bitcoin-backed lender Ledn, highlighted the reality: Every wrapper, bridge, and oracle between the lender and the underlying assets creates another place where loans go wrong. In his view, reducing the number of moving parts can directly reduce risk exposure, especially since each additional interaction increases the likelihood of failure. Ledn's practice is described as storing customer bitcoins in qualified custodians rather than lending them out to generate additional revenue. Wu bluntly pointed out that the only way to eliminate certain risks is to keep customer assets in segregated custody, implement strict controls and minimize flows.

Maple联合创始人兼首席执行官Sid Powell提供了另一个视角：“严肃的贷款人”应假设借款人随时可能失败，并从实时可见性、资产位置以及出现故障时的响应速度等问题倒推进行规划。Spark首席执行官Sam MacPherson同样指出了超越智能合约的更广泛责任——审查治理设计、运营安全、抵押品质量、流动性管理和生态系统依赖关系。

报告中的几个例子表明，这正在改变特定资产的处理方式。Spark于1月开始在SparkLend上逐步淘汰rsETH，早于4月的Kelp exploit，因为其结论是，该代币的低使用量和收入不足以证明支持它所增加的额外风险。Kulechov表示，Aave也引入了类似的机制，包括每季度重新审查资产以及在发生重大变化后再次审查。他还描述了在六个未达到链级标准的网络上进行的“有序清算”，将应对措施与可衡量的运营要求联系起来，而非临时反应。

AI的定位及其可能带来的安全复杂性

As news continues to circulate around AI-driven explosions, the report believes that AI can also help improve security for crypto-lending-at least when it serves as a tool into a disciplined testing and review pipeline. Based on the details attributed to Aave, the protocol is using AI-assisted testing in conjunction with traditional security processes. It reportedly used mutation testing to deliberately introduce errors in the V4 contract, and the test suite captured 271 of the 304 injection vulnerabilities. In a recent review of the Aave V3 and V4 codebases, three AI security tools reportedly generated 71 findings; after manual review, 20 were deemed valid. The remaining 51 serve as examples of why expert supervision may still be necessary, as AI is described as good at breadth and speed, but not enough to rely on alone.

Kulechov also warned that AI could be a double-edged sword. As AI agents are granted permissions and begin to manage capital on the chain, their permissions, inputs, and decision logic become new components that need to be protected like any other contract element. This brings new challenges to the next stage of growth. Not only is the industry working to keep existing code safe, it must also ensure that every new "jigsaw piece"-including automation and AI-assisted decision-making-can be monitored and contained when problems arise.

For readers who watch markets closely, the next test is not just whether lending TVLs continue to rise, but whether protocols increasingly quantify and manage interdependence risks-particularly in terms of bridges, oracles, governance changes, and operational controls-and whether they can demonstrate containment plans when external faults spread between connected systems.