DeFi liquidity exits after $300M hack

TLDR

A roughly $300 million exploit of KelpDAO's rsETH bridge has sparked a sharp liquidity exodus from DeFi lending protocols, exposing how fragile interconnected collateral and bridges can be.

1. Attackers forged rsETH on KelpDAO via a LayerZero bridge bug, then used it as collateral across lenders like Aave to borrow real assets and leave large bad debt.
2. Within one to two days, DeFi lost over $13 billion in TVL and Aave alone saw more than $15 billion in deposits exit, as users rushed to pull liquidity and avoid being trapped.
3. The incident highlights systemic risk from single?verifier bridges and complex collateral, likely pushing DeFi toward stricter risk controls and more conservative collateral onboarding.

Deep Dive

1. How The $300M Hack Worked

KelpDAO's rsETH is a liquid restaking token that users move across chains using a LayerZero-powered bridge.

On April 18, attackers compromised the bridges verification setup, which relied on a single signer, and fabricated a transaction that released about 116,500 unbacked rsETH, worth around $290300 million, to their address. Reports detail how these fake rsETH tokens were then supplied to major lenders like Aave as collateral, allowing the attacker to borrow large amounts of real ETH, wETH and other assets, leaving protocols holding illiquid rsETH and significant bad debt.[](https://www.coindesk.com/business/2026/04/19/the-usd292-million-kelp-exploit-how-it-happened-and-what-it-means-for-defi)

Aaves core contracts were not directly hacked, but they treated rsETH as valid collateral, similar to accepting forged collateral at a bank.

2. How Big The Liquidity Exit Is

The exploit triggered a fast, bank?run style exit from DeFi. One analysis estimates total DeFi TVL fell from about $99.5 billion to $85.3 billion, a roughly $14.2 billion loss within 24 hours of the incident.[](https://news.bitcoin.com/14b-vanishes-from-defi-ecosystem-after-kelpdao-exploit-rocks-lending-markets)

Aave was hit hardest: one report shows its deposits dropping from $48.5 billion to $30.7 billion in 3.5 days, a $15.1 billion exit, as key pools like WETH hit 100% utilization and some withdrawals were effectively locked.[](https://finance.yahoo.com/markets/crypto/articles/where-did-aave-15b-kelpdao-105215197.html) Other protocols, including Morpho and several smaller platforms, saw multi?digit percentage TVL declines, while a handful like SparkLend gained TVL as users rotated into venues perceived as more conservative.

Broader data also shows DeFi TVL down about 7 percent in a day, with some chains seeing 1525 percent TVL drops, reinforcing a sector?wide confidence shock, not just a KelpDAO issue.?

3. Systemic Risks And What To Watch

This episode underlines three structural risks.

1. Bridge design: Single?verifier or poorly diversified bridge setups create a single point of failure that can corrupt collateral across many protocols.
2. Collateral onboarding: Lenders that accept complex, newer assets without strong isolation or conservative parameters inherit bridge and protocol risk they do not control.
3. Contagion through TVL: When one widely used asset fails, bad debt plus fear can quickly drain liquidity across unrelated pools and chains.

Going forward, useful signals to monitor include: whether major lenders tighten collateral criteria or migrate to multi?verifier bridges, how fast Aave and peers work down bad debt, and whether institutional narratives shift toward safer venues or on?chain assets with simpler risk profiles.

Conclusion

A roughly $300 million rsETH bridge exploit did more than drain one protocol; it triggered a multi?billion dollar liquidity rush out of DeFi, with Aave and other lenders at the center. The episode shows how cross?chain design and collateral choices can turn a single validator failure into a sector?wide stress test, making future risk controls and bridge governance key things to watch for anyone using DeFi.