Crypto Lending Surges to $56 Billion Amid AI Security Fears in DeFi

Crypto lending is back. Hard. The market has jumped 55% since July, pushing total lending value to roughly $56 billion — and the speed of that rebound is making a lot of people nervous.

The growth sounds great on paper. But the people actually running these protocols aren’t popping champagne. They’re stress-testing their code, rethinking their infrastructure dependencies, and quietly worrying about a new breed of threat: AI-assisted attacks on a sector that’s still working out its own security fundamentals. The combination of fast-moving capital and evolving attack vectors is, basically, a hard problem to solve.

The Kelp DAO Incident That Spooked Aave

Pull back to the second quarter and things looked pretty rough. The sector saw $11.33 billion walk out the door, and a big chunk of that came down to one incident. A hack involving Kelp DAO rattled confidence across the board — and Aave, one of the most prominent lending protocols in DeFi, got caught in the blast radius. Not because Aave’s smart contracts broke. They didn’t. But users found themselves locked out of their ETH, and that was enough. Deposits fell by $15 billion as people pulled out.

That episode changed how Aave thinks about security. Smart contract audits used to be the main event. Now the focus has widened to include bridge risks and infrastructure dependencies — the stuff that sits outside the contract itself but can still bring the whole thing down. It’s a meaningful shift in how the industry frames its threat model.

Sid Powell, co-founder of crypto credit platform Maple, and Sam MacPherson, CEO of DeFi lender Spark, both think internal and external risks deserve equal attention. MacPherson’s team acted early: Spark started phasing out rsETH back in January, citing its high risk and low yield. That decision came before the Kelp DAO exploit hit. Probably a smart call in hindsight.

AI Catches Bugs — But Creates New Ones

Aave has started weaving AI-assisted testing into its security stack. In test scenarios, the AI flagged 271 vulnerabilities. That’s genuinely impressive throughput — AI moves fast and casts a wide net. But there’s a catch, and it’s a big one. A significant portion of those findings are false positives. Human reviewers still have to sort through the noise, which means AI isn’t replacing the security team, it’s adding to their workload in a different way.

And here’s the part that doesn’t get talked about enough: as AI agents take on more responsibility for managing on-chain capital, those agents themselves become targets. Their permissions, their decision-making logic, their access controls — all of it needs the same scrutiny as any other protocol component. Probably more, actually, given how fast AI capabilities are moving.

More context: Vitalik Buterin Sounds Alarm on AI Threats to Crypto Wallet Security

Shawn Owen, CEO of SALT Lending, keeps coming back to human error as the vulnerability that gets underestimated. Mismanaged key controls. Social engineering. Operational slip-ups that no smart contract audit would ever catch. He’s seen it. The 2022 collapses of Celsius, Voyager, and BlockFi weren’t purely technical failures — they were also failures of risk management, asset oversight, and judgment. Those names should still sting for anyone in the lending space.

Yield Pressure and the Risk of Moving Too Fast

When deposits flood in fast, managers face a familiar trap. They need to put capital to work to maintain yields, and the pressure to do that quickly can push people toward decisions they’d normally think twice about. It’s not a new problem in finance, but DeFi’s speed and composability make it worse. One bad collateral decision, one overlooked dependency, and the damage can spread faster than anyone can react.

Thomas Wu, CFO at Ledn, has a pretty clear view on this. Ledn stores client assets with qualified custodians rather than chasing extra yield by lending them out further. Wu’s logic is straightforward: every additional transaction is another potential failure point. Keep the chain short, keep the risk contained. It’s a conservative approach, but it’s one that’s kept Ledn out of the headlines for the wrong reasons.

Protocols are also getting sharper about collateral quality. The Kelp DAO episode made clear that the risk profile of any asset you accept as collateral includes the infrastructure that asset depends on — bridges, oracles, wrapped token mechanics. You can’t just audit the token itself and call it done.

The pressure to maintain attractive yields can lead to risky decision-making, especially when deposits increase rapidly. That’s not speculation — it’s basically what happened to the lenders that collapsed in 2022. Fast growth, misunderstood risks, not enough margin for error.

Read also: Standard Chartered Launches Crypto Custody Services in Singapore with Zodia Deal

Crisis response planning is getting more attention too. Preventing failures is the goal, obviously. But Aave’s experience showed that having a fast, clear response when something goes sideways matters just as much as the prevention work. Protocols that can adapt quickly, communicate clearly, and contain damage have a real edge.

AI’s role in all of this is still being worked out. It’s a useful tool. It’s also, potentially, an attack surface. The industry hasn’t fully squared that circle yet.

Ledn’s approach — minimize transactions, use qualified custodians, don’t chase yield — currently puts total lending value at roughly $56 billion across the sector.