DeFi exploits drive surge in ETH exits

TLDR

DeFi hacks in April have triggered a sharp spike in Ethereum (ETH) withdrawals from restaking and DeFi protocols, pushing staking exits to unusually high levels.

1. A series of large DeFi exploits, led by KelpDAO and Drift, drove ETH out of restaking platforms and lending protocols.
2. Ethereums validator exit queue exploded, but a much larger entry queue suggests rotation within staking rather than a full-scale exit.
3. The key variables now are exploit frequency, DeFi security upgrades, and whether confidence returns to restaking and lending markets.

Deep Dive

1. How DeFi Exploits Triggered ETH Exits

April 2026 was the worst month on record for DeFi hacks, with about $625635 million lost across roughly 2930 incidents, according to multiple reports that track exploit data. One of the largest events was the KelpDAO rsETH bridge exploit on 18 April, where attackers stole around $290292 million in restaked ETH through a LayerZero-based cross chain bridge vulnerability, an incident later linked to North Koreas Lazarus Group by investigators on the bridge team.

Coverage notes that this hack, together with a $285 million exploit at Drift Protocol, accounted for over 90 percent of Aprils losses and was followed by a roughly $1314 billion drop in DeFi total value locked within about 48 hours, including Aave deposits falling from about $45.8 billion to $28.6 billion as users rushed to withdraw collateral and unwind leverage.

Analysts describe this as capital leaving all forms of defi because the perceived risk shifted from return on capital to return of capital, especially for leveraged and restaked positions.

2. What The ETH Exit Queue Tells You

In parallel, Ethereums validator exit queue surged to about 433,158 ETH on 3 May, with roughly a seven day wait, a move described as a 72,000 percent increase in only two weeks and directly linked by market coverage to withdrawals from restaking platforms. This indicates that some stakers chose to exit or rotate after seeing bridge and restaking specific risks materialize.

However, the same data shows about 3.6 million ETH in the staking entry queue with an estimated 62 day wait, around seven times larger than the exit queue, and total staked ETH still at about 38.6 million, roughly 31.7 percent of supply, with yields near 2.9 percent. That pattern points to a rotation away from higher risk DeFi exposure and toward base staking, rather than a wholesale abandonment of Ethereum staking itself.

3. What To Watch Next For ETH And DeFi

Short term, the main driver will be whether exploit frequency stays elevated or drops. If hacks remain frequent or grow in size, risk premiums for restaking tokens, bridges, and leveraged DeFi strategies are likely to stay high and ETH could continue to migrate out of those venues.

At the same time, the industry response matters. Initiatives such as the DeFi United recovery fund, which has raised over one hundred thousand ETH to backstop losses from the KelpDAO hack, and moves like Arbitrums security council freezing attacker funds, show a trend toward stronger guardrails and coordinated incident response around critical DeFi infrastructure.

If exploit volume cools while the entry queue remains larger than exits, the most probable path is that staking queues normalize and some capital slowly returns to DeFi protocols that demonstrate improved security, clearer governance, and better audit practices.

Conclusion

DeFi exploits have clearly shaken confidence in restaking and leveraged DeFi, driving a visible spike in ETH exits from those segments. At the same time, the larger staking entry queue and stable total staked ETH suggest capital is rotating toward lower risk Ethereum exposures rather than leaving the ecosystem entirely. How quickly DeFi tightens its security and how exploit trends evolve will determine whether this is a temporary risk reset or a longer lasting shift in how ETH is used onchain.