DeFi TVL drops $14B after KelpDAO exploit

TLDR

A roughly $290 million exploit of KelpDAOs rsETH restaking token has coincided with about $14 billion exiting DeFi, exposing systemic risks around cross chain collateral and bridges.

1. Attackers forged cross chain messages for KelpDAOs rsETH, minting about 116,500 unbacked tokens and using them as collateral across lending markets.
2. DefiLlama data shows DeFi TVL fell from around $99.5 billion to about $85.3 billion, with Aave alone losing over $810 billion of TVL and other protocols seeing double digit drops.
3. The next key signals are KelpDAOs forensic report, Aaves bad debt plan, and LayerZeros bridge upgrades, which will shape whether this shock becomes a lasting repricing of DeFi risk.

Deep Dive

1. How The KelpDAO Exploit Worked

Reports say KelpDAOs rsETH liquid restaking token used a LayerZero based bridge with a 1 of 1 verifier setup instead of a multi validator design, leaving a single point of failure. A detailed breakdown notes that attackers compromised infrastructure feeding this verifier and injected a fraudulent cross chain message, allowing them to mint roughly 116,500 rsETH (about 280300 million dollars and around 18 percent of supply) without backing collateral. The exploiter then deposited large amounts of this unbacked rsETH into lending protocols like Aave and borrowed roughly 190236 million dollars in ETH and related assets across Ethereum and Arbitrum, turning a bridge misconfiguration into protocol level bad debt risk.

2. Why DeFi TVL Dropped About $14 Billion

According to DefiLlama data cited by multiple outlets, total DeFi TVL fell from about 99.49 billion dollars to roughly 85.32 billion dollars, a drop of about 14.17 billion dollars within a couple of days of the exploit, reaching a one year low near 85 billion dollars and roughly 50 percent below prior peaks. Aave was the epicenter: its TVL dropped more than 30 percent, from around 2626.4 billion dollars to roughly 1718 billion dollars, accounting for over half of sector wide outflows and allowing Lido to overtake it by TVL. Other lending and yield protocols such as Spark, Morpho, Curve, Pendle and several smaller platforms also posted double digit weekly TVL declines, even when they had limited direct rsETH exposure, as users de risked broadly.

3. Systemic Risks And What To Watch Next

The incident shows how a single bridge or restaking token can propagate risk through DeFi when it is widely used as collateral; once rsETHs backing was in doubt, users rushed to withdraw from any protocol that accepted it. In response, Aave froze rsETH markets and cut its loan to value to zero, and several protocols including Ethena, Curve, ether.fi and Tron DAO reportedly paused LayerZero based OFT bridges, while the Arbitrum Security Council froze over 30,000 ETH linked to the exploit in a governance controlled address. Attribution from security firms and LayerZero points to North Koreas Lazarus Group, and markets are watching for KelpDAOs restitution plan, Aaves decision on who absorbs bad debt, and LayerZeros move to multi verifier bridge configurations to judge whether confidence returns or capital keeps rotating toward chains and protocols with simpler risk profiles.

Conclusion

The KelpDAO exploit turned a bridge configuration flaw into sector wide stress by injecting unbacked collateral into core lending markets, prompting users to pull roughly 14 billion dollars from DeFi in days. How KelpDAO, Aave and LayerZero handle losses, upgrades and compensation will determine whether this remains a sharp but contained shock or marks the start of a longer shift toward simpler, more conservatively engineered DeFi primitives.