Devoured - April 21, 2026
$13 Billion DeFi TVL Wipeout in Two Days Following Kelp DAO Hack (3 minute read)

$13 Billion DeFi TVL Wipeout in Two Days Following Kelp DAO Hack (3 minute read)

Crypto defisecurity Read original

A $292 million bridge exploit of KelpDAO triggered a two-day bank run across DeFi platforms, wiping out $13.21 billion in deposits as users panicked despite limited direct exposure to the hack.

What: Attackers exploited KelpDAO's LayerZero bridge to mint unbacked rsETH tokens, then used them as collateral to borrow real assets on lending platforms like Aave. This created bad debt risk and prompted protocol freezes, sparking mass withdrawals that pulled $8.45 billion from Aave alone and $13.21 billion from DeFi overall within 48 hours.
Why it matters: The incident demonstrates how DeFi's interconnected architecture can amplify localized exploits into systemic crises, with protocols having no direct exposure to the original attack experiencing withdrawal cascades reminiscent of traditional bank runs. Liquidity constraints pushed lending pools to 100% utilization and borrow rates to 10-15%, threatening leveraged strategies across the ecosystem.
Deep dive
  • The exploit worked like depositing counterfeit cash at a bank and taking out real loans—attackers created unbacked rsETH and borrowed legitimate assets against it, leaving lenders with potential bad debt
  • Total DeFi TVL dropped from $99.5 billion to $86.3 billion, while Aave specifically fell from approximately $26.4 billion to $18 billion in deposits over the 48-hour period
  • Despite massive deposit outflows, token prices moved modestly—AAVE down 2.5% in 24 hours, UNI and LINK under 1%—suggesting the panic was about solvency risk rather than fundamental protocol value
  • Protocols responded by freezing affected markets, but this defensive measure itself triggered broader withdrawals as users rushed to exit before their funds became locked
  • Liquidity stress manifested in borrow rates spiking to 10-15% and multiple lending pools hitting 100% utilization, creating margin compression for yield farmers and leveraged traders
  • Early analysis points to vulnerabilities in the bridge verification layer rather than smart contract bugs, highlighting persistent weaknesses in cross-chain infrastructure
  • Platforms like Euler and Sentora also saw double-digit percentage TVL drops despite having no direct connection to the rsETH exploit, illustrating DeFi's contagion dynamics
  • The episode reveals that DeFi's composability—usually touted as a feature—becomes a transmission mechanism for systemic shocks when trust breaks down
Decoder
  • TVL (Total Value Locked): the dollar value of crypto assets deposited across DeFi protocols, used as a liquidity and activity metric
  • rsETH: a liquid restaking token from KelpDAO that represents staked Ethereum with additional yield layers
  • LayerZero bridge: cross-chain infrastructure that enables asset transfers between different blockchains
  • Utilization rate: percentage of available funds in a lending pool that are currently borrowed; 100% means no liquidity remains for withdrawals
Original article

A $292 million exploit of KelpDAO's rsETH via the LayerZero bridge triggered a 48-hour DeFi-wide panic that erased $13.21 billion in TVL, pulling the sector from $26.4 billion to roughly $20 billion by April 20. Aave absorbed the sharpest blow, losing $8.45 billion in deposits as withdrawals cascaded into protocols unconnected to the original attack, driving the AAVE token down 18%. Liquidity constraints pushed multiple lending pools to 100% utilization and borrow rates to 10-15%, compressing margins for leveraged strategies across the sector.