DeFi TVL drops $13B after KelpDAO hack

TLDR

DeFi has seen roughly $13 to $14 billion pulled out in days after a $290 million KelpDAO exploit rippled through lending markets.

1. The attacker minted 116,500 unbacked rsETH via compromised LayerZero infrastructure and used it as collateral on Aave and other lenders, leaving around $196 million in bad debt.
2. DefiLlama data shows DeFi TVL dropping from about $99.5B to roughly $85B, with Aave losing an estimated $8B to $9B and Ethereum DeFi down over $10B in TVL.
3. The episode highlights systemic risk from liquid restaking, bridges and composability, and markets are watching how Aave and peers resolve losses and tighten collateral and infra rules.

Deep Dive

1. How The KelpDAO Hack Worked

On April 18, KelpDAOs rsETH liquid restaking token was hit by an exploit of its LayerZero based cross chain bridge, allowing an attacker to mint about 116,500 unbacked rsETH, roughly 18% of supply, worth around $292 million. Accounts from LayerZero and analysts describe an RPC and verifier attack on KelpDAOs single verifier configuration rather than a direct smart contract bug, as detailed in a technical post mortem.

Instead of dumping rsETH, the attacker deposited the fake collateral on blue chip lenders like Aave V3 and V4 to borrow real WETH and other assets, creating roughly $196 million of bad debt on Aave alone according to a market recap. Because rsETH had been whitelisted as high quality ETH correlated collateral, the exploit propagated into otherwise healthy money markets.

Several protocols with rsETH exposure, such as SparkLend and others, paused or froze positions while KelpDAO and LayerZero worked to contain the incident and law enforcement probes Lazarus Group links reported in multiple investigations.

2. Scale Of The DeFi Outflows

The exploit triggered a DeFi wide bank run rather than an isolated loss. Data aggregated by DeFiLlama and cited by multiple outlets shows total DeFi TVL falling from about $99.5 billion to roughly $85 billion, a drop of around $14 billion at the lows, and framed as a $13 billion two day loss in one macro brief.

One analysis notes TVL across tracked DeFi protocols fell by $14.17 billion to $85.32 billion, with Aave alone accounting for just over $8 billion of the outflows and its TVL dropping more than 30% to roughly $17 billion, as summarized in a sector wide review. Another review finds Ethereum DeFi TVL down about $10.34 billion in two days, with Aaves TVL sliding from $26.39 billion to about $17.5 billion and DeFis total TVL hovering near $85.4 billion by the same dataset.

Importantly, this happened while Bitcoin and large caps held up relatively well, suggesting a targeted de risk in DeFi rather than a market wide crash.

3. Why It Matters And What To Watch

This incident reveals how composability can turn an infra level mistake into a sector wide problem. A single liquid restaking token, integrated across 20 plus protocols, became a channel for toxic collateral that forced users to yank funds and created bad debt clusters.

Key next steps to watch include how Aave governance chooses to socialize or allocate losses, with scenarios from partial user haircuts to more concentrated bad debt being debated in an Aave focused analysis. Markets are also watching whether other lenders change risk parameters for restaking tokens and whether cross chain projects move to multi verifier setups and stricter RPC security, as urged in the LayerZero incident breakdown.

Conclusion

The KelpDAO exploit started as a roughly $290 million bridge attack but escalated into a $13 to $14 billion DeFi de leveraging as users repriced the risk of complex, cross protocol collateral. How lenders like Aave resolve bad debt and how quickly restaking and bridge projects harden their infrastructure will shape whether this remains a sharp but contained shock or marks a longer period of cautious capital in DeFi.