Lazarus-linked DeFi hack triggers $13B outflows

TLDR

A North Korea-linked hacking group is blamed for a major DeFi exploit that drained nearly $300 million and sparked around $13 billion in capital flight from DeFi.

1. North Koreas Lazarus Group has been tied to a roughly $292 million Kelp DAO exploit that abused a restaking bridge rather than Ethereum or Solana base layers.
2. The attack triggered more than $13 billion of DeFi TVL outflows, including billions leaving Aave and about $196 million in bad debt concentrated on that lending protocol.
3. DeFi governance responses and security upgrades, plus user risk habits, will determine whether this stays an Aave centric shock or accelerates a broader retreat from on chain lending.

Deep Dive

1. How The Lazarus-Linked Hack Worked

Security researchers and media reports link North Koreas Lazarus Group to a Kelp DAO exploit that stole about 292 to 294 million dollars from a restaked ETH product (rsETH) and its cross chain bridge. The core issue was a bridge bug that released rsETH on Ethereum without burning the matching amount on the source chain, creating a large backing shortfall and letting the attacker use the inflated rsETH as collateral on Aave and other protocols.

Coverage notes that this was not a chain level bug in Ethereum or Solana, but a combination of social engineering and bridge design flaws attributed to Lazarus, which has already been linked to roughly 577 million dollars in crypto hacks this month alone. The Arbitrum Security Council reacted by freezing around 71 million dollars of related ETH while the situation is worked through in governance.

2. Why It Triggered 13 Billion Dollars In Outflows

In the days after the exploit, total DeFi TVL fell by more than 13 billion dollars, according to multiple reports that track protocol balances. One analysis highlights over 8.4 billion dollars in deposits leaving Aave within 48 hours, with Aaves TVL dropping from roughly 48.5 billion to about 30.7 billion.

Because the attacker used rsETH as collateral on Aave, the protocol ended up with about 196 million dollars in bad debt. That concentrated the shock on DeFis largest lending venue and spooked depositors across other money markets, even though Ethereum and Solana themselves continued to process blocks normally and did not suffer consensus failures.

3. Response, Risks, And What To Watch

On the recovery side, a coalition of protocols including Aave Labs, KelpDAO, LayerZero, EtherFi, and Compound has proposed that Arbitrum governance release about 30,765 ETH that was frozen during the incident into a recovery multisig for rsETH users. Separately, a DeFi United effort led by Aave and major Ethereum projects has pledged tens of thousands of ETH to help plug the hole.

At the same time, security focused articles are emphasizing user level defenses such as segregating long term wallets, tightening token approvals, and treating bridges and restaking routes as high risk until their governance and audits improve. Prediction markets and research pieces point out that April has already seen more than 600 million dollars in protocol hacks and exploits, reinforcing the sense that another 100 million dollar plus incident is likely this year.

Conclusion

The Lazarus linked Kelp DAO exploit shows how a single bridge and collateral failure can erase hundreds of millions of dollars directly and unsettle more than 13 billion dollars of capital parked in DeFi. For now, the damage is concentrated in restaking and lending protocols rather than in Ethereum or Solana themselves, but user trust is clearly thinner. If governance can transparently resolve bad debt and harden bridge and restaking designs, DeFi can treat this as a painful but contained lesson rather than the start of a longer structural retreat.