TLDR
A $290 million exploit at KelpDAO triggered a rapid flight of capital, wiping roughly $14 billion from DeFi total value locked in a couple of days.
- The attacker abused KelpDAOs LayerZero bridge and rsETH token to mint unbacked collateral, then borrowed heavily on Aave and other lending protocols.
- DeFi TVL fell from about $99.5 billion to around $85 billion, with Aave alone losing over $8 billion in deposits and facing up to $230 million of potential bad debt.
- The incident exposes systemic bridge and composability risks, making upcoming loss-allocation decisions and security upgrades critical for the future of DeFi lending and restaking.
Deep Dive
1. How The Exploit Worked
KelpDAO issues rsETH, a liquid restaking token that moves across chains via a LayerZero-based bridge.
According to reports, the attacker forged a valid-looking cross-chain message so about 116,500 rsETH, worth roughly $290 million, were released on Ethereum without real backing, then deposited as collateral on Aave and borrowed around $190200 million in ETH and related assets against it, leaving Aave with potentially worthless rsETH collateral and frozen rsETH markets while losses are assessed.
LayerZero later linked the incident to North Koreas Lazarus group and to a single-verifier Decentralized Verification Network (DVN) setup at KelpDAO, highlighting that downstream infrastructure and configuration choices, not Aaves core contracts, were the weak point.
2. Scale Of DeFi Damage
The exploit triggered a classic DeFi bank run: users rushed to withdraw collateral and unwind positions touching rsETH or exposed money markets.
On-chain data aggregators tracked DeFi TVL sliding from about $99.5 billion to roughly $85 billion in under 24 hours, a loss near $14 billion, with Aaves share exceeding $8 billion of the outflow and Lido overtaking it as top protocol by deposits.
A separate analysis for the broader 48-hour window shows similar magnitudes, with Ethereum DeFi TVL down around 11 percent and major ecosystems like Solana, Arbitrum, Base and Avalanche all posting mid to high single digit percentage drops.
A concentrated failure in a single restaking bridge cascaded into sector-wide deleveraging, especially for protocols that had embraced rsETH as collateral.
3. Risks And What To Watch
Aaves incident report sketches scenarios where its bad debt could range from roughly $120 million to about $230 million, depending on whether losses are socialized across rsETH holders or concentrated on specific layer 2 markets.
At the same time, KelpDAO and LayerZero are under pressure to move from single to multi-DVN setups and to harden operational infrastructure, while other protocols reevaluate whether to accept bridged restaking assets as collateral at all.
For users and builders, the key signals now are how losses are allocated between KelpDAO, rsETH holders and Aave markets, whether large lenders return after the dust settles, and whether capital keeps rotating from DeFi into bitcoin and top-layer assets.
Conclusion
The KelpDAO hack did not break core DeFi smart contracts, but it showed how fragile the system becomes when collateral relies on complex cross-chain bridges and lightly scrutinized integrations.
Until lending protocols tighten collateral standards and bridge operators adopt stronger verification and operational security, shocks like this can rapidly erase billions from DeFi and push liquidity toward simpler, more battle-tested assets.
CoinsKid.Com