Sam MacPherson on Why Spark Benefited So Much From the KelpDAO Hack

Spark is a sub-DAO built on top of Sky, formerly MakerDAO, functioning like a commercial bank that draws on Sky's liquidity reserves to deploy into commercial lending. Sky operates more like a central bank and wholesale liquidity issuer, holds over 10 billion dollars in stablecoin deposits, and is the market leader in that category, with roughly 40 percent of its balance sheet deployed into various forms of lending. Sky is also one of the largest on-chain holders of USDC alongside Hyperliquid.

Sam MacPherson explained that Spark restructured from a flat DAO to a sub-DAO model because flat structures fail at scale as political factions and informal alliances form naturally when large amounts of money are involved. Under the sub-DAO model the core DAO sets rules and risk policy while sub-DAOs compete in the free market to deliver value, allowing individual units to move faster while preserving emergent decentralization at the structural level.

Spark's product suite includes a lending market focused on Bitcoin and ETH overcollateralized loans, Spark Savings which allocates capital across DeFi, CeFi, and TradFi with RWAs to optimize risk-adjusted yield on USDC and USDT, custodial Bitcoin-backed institutional lending facilitated through Anchorage as qualified custodian, and Spark Prime, a CeFi prime brokerage allowing hedge funds to margin positions across DeFi, CeFi, and TradFi venues including Hyperliquid. Spark Savings currently offers 3.6 percent on USDC and 2.75 percent on USDT. Institutional lending launched at the end of last year has reached 250 million dollars in loans issued, with MacPherson saying the pipeline is on track to reach a billion dollars and beyond by end of year.

Spark's TVL in ETH rose approximately 80 percent from mid-April at its peak and remained up about 50 percent by early July following the KelpDAO hack, with MacPherson stating Spark was a direct beneficiary because the rest of DeFi took a significant hit while Spark did not. The KelpDAO hack required a misconfiguration in the Layer Zero setup by the asset issuer and then a venue to convert to ETH, with Aave being the main venue used. The actor is assumed to be North Korea seeking to exit into decentralized assets like ETH and Bitcoin.

Spark avoided losses from the KelpDAO incident for several structural reasons. Rate limits have been in place on all Spark markets since shortly after its 2023 launch, capping the capital that can be extracted even if a collateral asset is compromised and deterring hackers who need immediate throughput. RSE was off-boarded from Spark in January as part of a general risk reduction strategy predating the exploit and was never onboarded into efficiency mode, only allowed for borrowing stablecoins with LTVs in the 60 to 70 percent range. MacPherson said that even without the RSE off-boarding, losses from the incident would likely have been zero or minimal and easily recoverable.

Spark runs a triple redundant oracle using Chainlink, Redstone, and Chronicle so a bad price from one provider does not cause a failure. All assets in the Sky protocol sit behind a time lock as a deliberate safety measure, and MacPherson noted that assets under custody with no time lock make a protocol a target, citing the Drift hack as an example. Spark currently accepts approximately five collateral assets: CBBTC, WBTC, Lido ETH, stETH, and Etherfyi. Standard governance takes roughly a month and passes through a risk council review, an SPK voter snapshot poll, and a final check by Sky, with an emergency multisig available to pause the protocol in urgent situations.

MacPherson said most major hacks are OpSec failures rather than smart contract failures and that basic security practices can address them. Phoenix Labs uses AI to complement human auditors, and MacPherson said AI is starting to match some of the best human auditors while simultaneously increasing offensive attack capabilities, making the current period a peak danger zone. Formal verification is the direction the industry is heading for smart contract security.

Spark was selected as one of three asset issuers backing Robinhood's 7 percent yield product via Spark Savings USDG. MacPherson identified a repeated market pattern where distribution channels pair with a chain and a proprietary stablecoin to capture net interest margin, as seen with Coinbase, Robinhood, Stripe, and Tempo. The SPK token is at or near its all-time low despite Spark performing well operationally. MacPherson said most tokens outside a few store-of-value exceptions will converge on a DCF valuation model similar to equity, and excess profits from Spark will go to SPK buybacks through governance. All value in the Spark ecosystem accrues to the SPK token, and Phoenix Labs does not raise money under the company entity.