The DeFi ecosystem absorbed one of its most structurally damaging exploits of the current cycle this weekend, and the full cost is still being counted. A $292 million exploit targeting Kelp DAO's LayerZero-powered cross-chain bridge on April 18 released 116,500 rsETH into circulation without any corresponding collateral backing. The attacker then deposited a large portion directly into Ethereum (ETH-USD) lending markets and borrowed significant amounts. Ethereum's DeFi ecosystem is now repricing risk across every layer of cross-chain infrastructure, and tonight's data makes clear this is not a contained incident.
How 116,500 Phantom ETH Carved a $230 Million Hole in Aave's Books
The mechanics of the exploit are crucial, highlighting risks bridges have carried for years. According to the incident report published on the Aave governance forum by Aave Labs and service provider LlamaRisk, the attacker forged a cross-chain transfer message that appeared valid to the bridge's verification layer. The system approved the transfer even though the underlying tokens never left the originating chain. The result: 116,500 rsETH were released on the receiving side with no real backing.
The attacker did not immediately sell these assets on the open market but deposited 89,567 rsETH into Aave as collateral, borrowing approximately $190 million in ETH and related assets across Ethereum and Arbitrum. Aave's systems acted as designed but had no on-chain method to distinguish the exploited collateral. The report outlines two resolution scenarios: if Kelp DAO distributes losses across all rsETH holders, the token faces an estimated 15% depeg, resulting in roughly $123 million in bad debt for Aave. If the losses are isolated to Layer 2 networks, bad debt could climb to $230 million. The final number remains unsettled. In response, Aave Labs froze rsETH markets, set loan-to-value ratios to zero, and halted new borrowing — though damage to the balance sheet occurred before these measures were implemented.
LayerZero Labs attributed the attack to TraderTraitor, a Lazarus Group subunit previously linked to the Drift Protocol exploit earlier this month. State-sponsored actors operating at this level of technical sophistication represent an elevated threat profile for DeFi, as highlighted by their exploitation of LayerZero bridge verification vulnerabilities using techniques like poisoned RPC nodes and DDoS against key verifiers.
TVL Plunge and Capital Flight Across DeFi Chains
No Stocks365 proprietary signals are currently active on a dedicated DeFi TVL instrument, but on-chain data illustrates capital withdrawal under stress. DeFi TVL declined across all top-20 chains following the exploit. Ethereum, which accounts for 53.91% of all DeFi TVL, lost 17.91% of its locked value over the past month, falling to $46.17 billion from over $56 billion before the hack wave began. Contagion spread to Solana, which dropped 19.04% monthly, and Arbitrum with a 16.00% monthly decline. Mantle's collapse — down 52.01% over 30 days, from over $600 million to $303 million — highlights the scale of withdrawals. Ethena, Curve Finance, ether.fi, and Tron DAO have frozen their LayerZero OFT bridges as a precaution, signaling growing systemic risk concerns around bridge infrastructure.
Only two chains in the top 20 posted positive monthly TVL gains: Tron at 24.07% and OP Mainnet at 82.11%, both benefiting from stablecoin flows seen as safer outside the Ethereum restaking ecosystem. This indicates capital is being reallocated within crypto rather than exiting altogether, and cross-chain bridge exposure is now a top risk variable.
Wormhole Exploit Parallel — and Risks of a Prolonged Crisis
Like the Kelp DAO incident, this produced unbacked tokens and triggered contagion. However, the Wormhole backer recapitalized losses within a day, containing protocol risk. Currently, Kelp DAO, which once carried over $2 billion in TVL, faces significant questions about its ability to make users whole. There is no announced backstop, putting long-term confidence at stake.
Capital flows in DeFi now appear primarily defensive. The sharp TVL drops are not limited to protocols with direct rsETH exposure; the precautionary freezing of bridges by unrelated protocols reinforces that the entire bridge infrastructure is perceived as a systemic risk. Containment hinges on Kelp DAO's allocation decision, as market participants await clarity on the distribution of losses.
Allocation Decision Looms—What Will Shape the Recovery Path?
Kelp DAO's shortfall allocation is the key variable. If losses are shared globally across all rsETH holders, Aave faces about $123 million in bad debt. If losses are isolated to Layer 2s, that exposure rises toward $230 million. All eyes are on the Aave governance forum and any forthcoming Kelp DAO announcement outlining a timeline and framework for handling the allocation.
The risk landscape for DeFi hinges on whether a credible recapitalization plan emerges and on stabilization of total DeFi TVL, particularly on Ethereum. The absence of an immediate backstop has already triggered a flight to perceived safety within DeFi, and further clarity on loss allocation will determine whether confidence stabilizes or further withdrawals accelerate.