DeFi TVL drops $14B after Kelp exploit

TLDR

DeFi has seen roughly $14 billion exit in days after a $292 million KelpDAO exploit exposed how fragile restaking collateral and cross?chain bridges can be.

1. A KelpDAO rsETH bridge exploit stole about $292 million and triggered a roughly $14.2 billion drop in DeFi TVL from around $99.5 billion to $85.3 billion.
2. Because stolen rsETH was widely used as collateral, lending platforms such as Aave saw bank?run style withdrawals, with Aave alone losing more than $8 billion in TVL.
3. Protocol freezes, bridge changes, and investigations into the attacks root cause will decide whether this is a short?term shakeout or a longer repricing of DeFi bridge and restaking risk.

Deep Dive

1. What Happened In The Kelp Exploit

KelpDAO, a liquid restaking protocol for Ether, suffered a major exploit on 18 April involving its rsETH cross?chain bridge. Attackers drained roughly 116,500 rsETH, worth about $292294 million at the time, by forging a LayerZero?powered cross?chain message.

Data from DefiLlama cited by multiple reports shows DeFi total value locked (TVL) falling from around $99.49 billion to roughly $85.3 billion, a decline of about $14.17 billion across protocols after the exploit and its fallout were recognized as a systemic event. One detailed analysis describes this as the largest DeFi hack of 2026 so far, with KelpDAOs incident pushing Aprils total crypto hack losses above $600 million.

Some investigations link the attack to North Koreas Lazarus Group (specifically the TraderTraitor subgroup) and highlight that KelpDAO used a single verifier configuration on LayerZeros DVN infrastructure, creating a critical single point of failure.

2. Why A $292M Hack Erased ~$14B In TVL

The key contagion channel was rsETH as collateral. Stolen rsETH, which no longer had real ETH backing, was deposited as collateral on lending protocols like Aave to borrow real assets such as WETH and ETH.

Because many platforms accepted rsETH, they suddenly faced toxic debt once it became clear the underlying collateral was stolen. Aaves TVL reportedly dropped from about $26 billion to the high?teens, losing over $8 billion and accounting for more than half of the sector?wide DeFi outflows of roughly $14.2 billion.

DefiLlama data cited in several reports shows TVL falling across all of the top 20 chains, with Ethereum losing over $10 billion in TVL in days, and other ecosystems like Solana, Mantle and Hyperliquid recording double?digit percentage declines.

3. Protocol Responses And What To Watch

In the immediate aftermath, Aave froze rsETH markets on its V3 and V4 deployments and urged some liquidity providers to withdraw or de?risk positions. Other protocols including Ethena, ether.fi, Tron DAO, Curve Finance, and additional rsETH?linked platforms paused or tightened their LayerZero bridge configurations.

LayerZero has said it will no longer support single?verifier (1/1 DVN) setups and is working with law enforcement, while emphasizing that multi?verifier configurations were not impacted. This shifts attention to operational choices around bridge infrastructure, not only smart?contract code.

For users and builders, the key forward signals are: whether TVL stabilizes on core blue?chip protocols, how quickly rsETH?exposed markets are reopened or redesigned, and whether other bridges quietly harden their verifier setups. Persistent TVL outflows or further incidents would suggest a deeper structural repricing of DeFi risk rather than a one?off shock.

Conclusion

A single architectural mistake around KelpDAOs rsETH bridge turned a $292 million theft into a roughly $14 billion DeFi liquidity shock, with Aave and other collateral?heavy protocols at the center. The episode underlines that DeFis composability and shared restaking collateral amplify both efficiency and systemic risk, and the sectors response on bridge design, collateral standards, and market limits will shape whether confidence returns or risk premia stay elevated.