Connect with us
DAPA Banner

Crypto World

DeFi Losses Surpass $600M as Kelp DAO Exploit Pushes TVL to One-Year Low

Published

on

🐳

The Kelp DAO exploit on April 18, 2026, in which attackers minted 116,500 unbacked rsETH by poisoning a single LayerZero verifier node, has catalyzed more than $600 million in sector-wide DeFi losses over recent weeks, with cumulative damage across protocols approaching $1 billion.

The downstream effect is now visible on-chain: total value locked across DeFi has collapsed to its lowest point in twelve months, per DefiLlama data, as capital flight accelerates across restaking, lending, and cross-chain bridge protocols.

The core question this raises isn’t whether Kelp DAO failed, it did, architecturally. The question is whether a single misconfigured verifier just exposed a systemic fragility running underneath the entire cross-chain DeFi stack.

Key Takeaways:
Advertisement
  • Total DeFi losses: Approximately $1 billion across recent weeks, with $600M+ directly attributable to the Kelp DAO exploit and its contagion effects.
  • Kelp DAO exploit scale: 116,500 unbacked rsETH minted – roughly 18% of circulating supply – via compromised LayerZero DVN node; no smart contract breach.
  • TVL impact: DeFi total value locked at a one-year low following a $13 billion exodus within 48 hours of the exploit.
  • Protocols affected: Aave, SparkLend, and Fluid all froze rsETH markets; Aave TVL fell from $26.4B to approximately $18B – the largest single-protocol casualty.
  • Attribution: LayerZero named North Korea’s Lazarus Group – specifically the TraderTraitor subunit – as the likely perpetrator; not yet formally confirmed.
  • Key watch item: Kelp DAO’s forthcoming forensic report and Aave’s bad debt resolution on tainted rsETH collateral are the two signals that will determine whether contagion stabilizes or deepens.

Discover: The best crypto to diversify your portfolio with

How a Single Verifier Node Took Down $600M in DeFi

The failure was architectural, not foundational, and that distinction matters for how you assess the rest of DeFi’s cross-chain infrastructure. Kelp DAO’s rsETH bridge relied on a single Decentralized Verifier Network node to authenticate LayerZero messages, a 1-of-1 configuration that security firm Halborn had flagged in prior warnings.

The attackers, identified by LayerZero as Lazarus Group’s TraderTraitor subgroup, compromised two RPC nodes feeding data to that verifier, launched DDoS attacks against backup nodes to force failover, then injected a fraudulent message that minted 116,500 rsETH against zero underlying collateral.

The stolen rsETH moved quickly. On-chain data shows the attacker swapped into ETH and Arbitrum using loans across Aave, SparkLend, and Fluid, with Tornado Cash deployed for gas fee obfuscation. Malware self-deleted from the compromised RPCs post-attack, deliberately erasing forensic logs. For more on how LayerZero’s investigation attributed the attack, the mechanics of the RPC poisoning sequence are documented in detail.

Advertisement

Losses aggregated fast. The 116,500 minted rsETH seeded bad debt across lending markets that had accepted rsETH as collateral without adequate verification of its backing, an “echo chamber” for forged messages, as Halborn described it. Allium, analyzing the verification gap post-incident, noted that “the tools worked as designed. The way they were configured did not.”

That’s not a minor footnote: it means the exploit required no zero-day vulnerability, just a misconfiguration that was documented and warned about in advance.

Single-point-of-failure verifier architectures are now a documented attack surface, and Kelp DAO won’t be the last protocol running one.

Advertisement

TVL at a One-Year Low: What the Capital Flight Data Actually Signals

DeFi’s aggregate TVL had already been compressing through Q1 2026 under macro pressure, but the Kelp DAO exploit accelerated the drawdown into a vertical drop.

DefiLlama data shows a $13 billion TVL exodus within the 48 hours following the April 18 attack, a pace that blindsided protocols like Compound that had no direct rsETH exposure but caught contagion withdrawals anyway.

The single-protocol casualty numbers are starker. Aave’s TVL collapsed from $26.4 billion to approximately $18 billion after the protocol froze rsETH markets, a $8.45 billion drawdown driven by users de-risking ahead of potential bad debt crystallization from tainted collateral positions.

Advertisement

Aave’s risk team is now modeling two bad debt scenarios depending on recovery rates for the unbacked rsETH that was used as loan collateral before markets were frozen.

The TVL compression sets up two distinct forward scenarios. If outflows stabilize and Kelp publishes a credible forensic report with a compensation mechanism, the current level may prove to be localized contagion, ugly but bounded. If Aave’s bad debt modeling surfaces material losses and LayerZero’s multi-DVN upgrade timeline extends past Q2, expect a second leg of TVL decline as yield seekers rotate entirely out of restaking protocols into less interconnected alternatives.

Governance token valuations are already pricing the first scenario as optimistic, AAVE has shed over 20% since the exploit, and the recovery thesis depends entirely on whether Aave can close its rsETH exposure cleanly.

Discover: The best pre-launch token sales

Advertisement

The post DeFi Losses Surpass $600M as Kelp DAO Exploit Pushes TVL to One-Year Low appeared first on Cryptonews.

Source link

Advertisement
Continue Reading
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Crypto World

New York Sues Coinbase, Gemini Over Unlicensed Markets

Published

on

New York State, Polymarket, Kalshi, Prediction Markets

New York’s attorney general has filed lawsuits against crypto exchange operators Coinbase Financial Markets and Gemini Titan for allegedly violating state gambling laws, according to court records cited by Reuters.

Copies of the complaints show the state alleges both exchanges failed to obtain licenses from the New York State Gaming Commission to operate their markets, Reuters reported

“Gambling by another name is still gambling, ​and it ​is not ⁠exempt from regulation under our state laws and Constitution,” Attorney General Letitia James said in a statement.

James said the lawsuit seeks to recover alleged illegal profits from operating prediction markets in the state, as well as restitution, and would bar Coinbase and Gemini from offering such products to individuals under 21 years of age.

Advertisement
New York State, Polymarket, Kalshi, Prediction Markets
Source: Office of New York State Attorney General

Related: Polymarket in talks to raise $400M at a $15B valuation: Report

State regulators crack down on prediction markets

The move fits into a broader push by state regulators, including New York, to assert control over prediction markets, which occupy a fast-growing corner of crypto commerce that allows users to bet on real-world events.

Much of the recent scrutiny has centered on platforms like Polymarket and Kalshi, which have drawn questions over whether their products fall under financial regulation or gambling laws.

The tension has also reached the federal level. The Commodity Futures Trading Commission (CFTC) has taken legal action against several states attempting to regulate prediction markets, arguing it has sole authority over the sector.

New York’s lawsuit underscores a key risk for crypto companies. Even as the federal stance has softened, state-level enforcement remains active. By targeting prediction-style markets, regulators may be opening a new front — one that could force platforms to rethink how these products are offered in major jurisdictions.

Advertisement

Nevertheless, not every company is taking it lightly. As Cointelegraph reported, Polymarket has filed a lawsuit against Massachusetts, arguing the state lacks authority to regulate prediction markets approved by the CFTC.

New York State, Polymarket, Kalshi, Prediction Markets
Source: Neal Kumar, chief legal office, Polymarket

Related: NYSE parent ICE completes new $600M investment in Polymarket