TLDR
A roughly $292300 million exploit of KelpDAOs rsETH restaking token triggered panic withdrawals of about $14 billion from DeFi in just a couple of days.
- The hack abused KelpDAOs cross?chain bridge design, minting 116,500 unbacked rsETH and turning it into real ETH and other assets used across lending markets.
- Because rsETH was widely used as collateral, major protocols like Aave saw frozen markets, 100 percent utilization, and over $68 billion in TVL outflows, driving a broader $1314 billion DeFi TVL drop.
- The incident exposes systemic risks in bridges and restaking collateral; users should watch for stricter risk controls, bridge redesigns, and whether TVL returns or keeps bleeding from DeFi.
Deep Dive
1. How The KelpDAO Exploit Worked
On 18 April 2026, an attacker exploited KelpDAOs rsETH cross?chain bridge, forging messages so that its Ethereum adapter released 116,500 rsETH (around 18 percent of rsETH supply) without backing. Reports put the direct loss near $292300 million. LayerZero has attributed the attack to North Koreas Lazarus Group and pointed to a misconfigured one?of?one verifier setup in its Decentralized Verifier Network, where compromised RPC infrastructure allowed the forged messages to pass as valid.
The attacker then moved quickly to deposit the fake rsETH into lending protocols and swap portions for ETH and other assets, ultimately holding over $240 million in ETH according to on?chain analysis.
The core failure was in cross?chain verification, not a simple buggy DeFi contract, highlighting that infrastructure layers can be the weak link.
2. Why It Triggered A $14B TVL Exodus
Because rsETH had been integrated as collateral across blue?chip DeFi protocols, the fake rsETH could be used to borrow real assets. On Aave alone, the attacker borrowed roughly $196236 million in ETH and WETH, helping push ETH, USDT, and USDC pools to 100 percent utilization and trapping remaining depositors.
Panic withdrawals followed. Aaves TVL fell from around $26 billion to near $1820 billion (about $68 billion out), while sector?wide DeFi TVL slid from roughly $99.5 billion to about $8586 billion, a loss around $1314 billion in a couple of days, as tracked by DeFi data aggregators and summarized in sector coverage of the $14.17 billion TVL drop.
Other protocols with rsETH exposure (Compound, Spark, Euler and others) froze markets, and even unrelated platforms saw outflows as users repriced DeFi risk.
One compromised collateral asset can force a scramble for exit and make withdrawals impossible for those who do not move first.
3. Systemic Risks And What To Watch
Analysts are calling for mandatory multi?verifier bridge setups, stricter caps on new collateral types, and slower onboarding of exotic assets like restaking tokens. Some chains and protocols are already reviewing cross?chain configurations and risk frameworks in response.
For users, the key variables are:
- how quickly protocols can resolve bad debt and restore normal utilization,
- whether regulators or large institutions change their stance on DeFi risk, and
- whether TVL stabilizes or continues drifting to safer venues like large L1 staking and centralized platforms.
Until bridges and restaking collateral are governed more conservatively, large cross?protocol integrations can turn a single exploit into a sector?wide liquidity shock.
Conclusion
A record?size DeFi infrastructure hack at KelpDAO cascaded into a roughly $14 billion flight of capital from DeFi, with lending protocols absorbing most of the shock. The episode shows that composability and restaking can magnify hidden infrastructure risks, so the future of DeFi will hinge on whether bridges, collateral onboarding, and risk limits evolve fast enough to prevent the next systemic liquidity crunch.
CoinsKid.Com