TLDR
The KelpDAO exploit was a roughly $300 million restaking-bridge hack that triggered about $14 billion of capital to exit DeFi in a few days.
- Attackers forged messages to mint 116,500 unbacked rsETH on KelpDAOs LayerZero bridge, draining around $290300 million and seeding bad debt across lending protocols that accepted rsETH as collateral.
- Panic withdrawals and risk controls after the exploit drove a roughly $14.17 billion drop in DeFi TVL, with Aave alone losing over $8 billion in deposits and total DeFi TVL hitting a one-year low.
- The incident exposed structural risk in cross-chain and restaking infrastructure, pushing teams to harden verifier settings and raising questions about how lending protocols should price and limit restaked collateral.
Deep Dive
1. How The KelpDAO Exploit Worked
Reports say the attacker compromised a single LayerZero verifier node used by KelpDAOs rsETH bridge, plus related RPC infrastructure, and injected a fraudulent cross-chain message to mint 116,500 unbacked rsETH, about 18% of supply at the time.116,500 unbacked rsETH were then rapidly deposited as collateral on lending markets, mainly Aave, to borrow roughly $190 million in ETH and other assets.
Security firms and LayerZero have attributed the operation to North Koreas Lazarus Group (TraderTraitor cluster), though this has not yet been formally confirmed by regulators.LayerZero-linked analysis points to Lazarus Group.
This was not a classic smart contract bug but an architectural and configuration failure around a 1-of-1 verifier, turning a single infrastructure compromise into system-wide fake collateral.
2. Why DeFi Lost About $14 Billion Of TVL
The direct theft was under $300 million, but knock-on effects were much larger because rsETH was widely used as collateral in blue-chip DeFi.
DefiLlama data cited by multiple outlets shows DeFi TVL dropping from about $99.49 billion to $85.32 billion, a $14.17 billion exodus within days of the April 18 attack.The $14.17 billion TVL exodus was concentrated in lending and restaking venues. Aaves TVL fell from roughly $26.4 billion to around $1718 billion, and it may face up to $230 million in bad debt depending on how losses are shared.Aave could face up to $230 million in bad debt.
Across chains, DeFi TVL declined on all of the top 20 networks; Ethereums DeFi TVL dropped about 18% month-on-month, Solana around 19%, and some smaller ecosystems like Mantle lost more than half their TVL.DeFi TVL dropped across all top 20 chains.
The headline $14B erased reflects risk-off withdrawals and deleveraging, not $14B stolen; users repriced restaking and cross-chain risk across the board.
3. What Changes Next For DeFi And Restaking
Immediate responses included freezing rsETH markets, setting rsETH loan-to-value to zero, and pausing many LayerZero-based OFT bridges while teams audited verifier configurations.Aaves incident response and bridge pauses are likely to become a template. The exploiters funds were partially frozen on Arbitrum, with about 30,766 ETH recovered, and the rest is being laundered through cross-chain swap protocols.Arbitrums security council froze part of the stolen ETH.
Going forward, key variables are:
- Whether KelpDAO offers credible restitution and a clear forensic report.
- How Aave and similar DAOs socialize or ring-fence bad debt.
- How fast bridge providers move from single-verifier setups to multi-DVN or quorum-based verification.
For DeFi users, the main practical shift is that cross-chain and restaked collateral will likely face tighter caps, higher risk parameters, and more scrutiny before protocols accept it again.
Conclusion
The KelpDAO exploit turned a configuration-level bridge failure into a sector-wide de-risking event, with a few hundred million dollars stolen but roughly $14 billion of TVL choosing to exit DeFi. Whether this becomes a temporary shock or a lasting drag on restaking and cross-chain activity depends on how quickly infrastructure is hardened and how transparently protocols handle the resulting bad debt and user losses.
CoinsKid.Com