TLDR
A $290292 million exploit of KelpDAOs rsETH bridge has triggered a sharp, multi billion dollar risk off move across DeFi lending.
- Attackers forged cross chain messages to mint 116,500 rsETH, draining roughly $290292 million and creating large bad debt on Aave and other protocols.
- Panic de leveraging and withdrawals erased over $13 billion of DeFi TVL overall, including about $15.1 billion pulled from Aave as users rotated to safer venues and stablecoins.
- The incident spotlights bridge and rehypothecation risk and could slow institutional DeFi and tokenization plans until cross chain security and risk controls improve.
Deep Dive
1. How The KelpDAO Exploit Worked
KelpDAO is a liquid restaking protocol that issues rsETH, a token backed by staked ETH routed through EigenLayer. Its cross chain bridge relied on LayerZeros messaging stack.
On 18 Apr 2026, attackers compromised RPC infrastructure that LayerZeros verifier used, then forced failover to poisoned nodes, allowing a forged cross chain message to be treated as valid. The bridge released 116,500 rsETH worth about $290292 million to the attacker, roughly 18 percent of rsETH supply, making this one of 2026s largest DeFi exploits so far.
The attacker then deposited tens of thousands of rsETH as collateral on Aave, borrowing real ETH and staked ETH derivatives. When rsETH backing broke, Aave was left with an estimated $120230 million in bad debt according to analyses of the impaired positions and possible loss socialization paths.
A single compromised verifier and trusted-bridge assumption let an attacker turn synthetic collateral into real assets, stressing any protocol that treated rsETH as safe money.
2. Why It Triggered 1315 Billion In Outflows
News of the exploit and undercollateralized rsETH sparked a rapid bank run on Aave and related venues. Within a few days, Aave lost about $15.1 billion in deposits as users unwound leverage and withdrew liquidity, with key pools hitting 100 percent utilization and briefly trapping some withdrawals.
Across DeFi more broadly, total value locked dropped by more than $13 billion within roughly 48 hours as capital fled restaking exposures and complex cross chain collateral stacks toward simpler positions and cashlike assets. Some of that money moved into protocols viewed as more conservative, such as SparkLend and real world asset platforms, while a large share parked in stablecoins like USDC or repaid loans.
The headline number does not mean $15 billion left crypto entirely, but it does show how quickly fear about one collateral type can force system wide deleveraging.
3. Longer Term Risks And What To Watch
Security researchers and banks now frame the hack as a structural wake up call. April 2026 has already seen more than $600 million lost to DeFi exploits, with KelpDAO and Drift accounting for the vast majority, and analysts warn that institutions may reassess the pace of DeFi tokenization until bridge architectures harden.
Key governance questions now include whether KelpDAO socializes losses across all rsETH holders, how Aave allocates or absorbs bad debt, and how quickly major protocols migrate away from single verifier or 1 of 1 bridge configurations. On chain, the attacker has begun laundering funds via L2s and THORChain, while Arbitrums Security Council has already frozen a sizable slice of stolen ETH, raising debates about emergency powers versus decentralization.
For DeFi users, risk now clusters around complex restaking and cross chain collateral strategies, so monitoring bridge designs, collateral standards, and how this bad debt is resolved is critical.
Conclusion
The KelpDAO exploit is less about one protocol and more about the fragility of interconnected, cross chain collateral systems in DeFi. A forged bridge message turned into hundreds of millions in bad debt and prompted tens of billions of dollars of deleveraging and rotation into simpler, better controlled venues. Until bridges and rehypothecation layers adopt stricter verification and risk limits, similar incidents could repeatedly test confidence in DeFis lending stack and slow institutional adoption.
CoinsKid.Com