DeFi Suffers $13 Billion Loss in 48 Hours Following KelpDAO Breach

A massive exodus of capital from the decentralized finance ecosystem has occurred in the wake of the KelpDAO protocol's recent exploitation. Over the past two days, Aave, a leading DeFi lending platform, has seen a staggering $8.45 billion withdrawal in deposits, contributing to a broader decline of $13.21 billion in total value locked across DeFi. The total value locked, which represents the combined dollar value of crypto assets deposited across DeFi protocols, plummeted from $99.497 billion to $86.286 billion. Aave's TVL alone dropped by $8.45 billion to $17.947 billion during this period, according to data from DefiLlama. Many protocols, including Euler, Sentora, and Aave, have reported double-digit percentage losses, primarily in lending, restaking, and yield strategies tied to the affected collateral. The crisis began with a $292 million exploit of Kelp's bridge, which allowed attackers to misuse stolen rsETH, a widely used liquid re-staking token in DeFi, as collateral to secure loans on lending platforms. As these stolen tokens lacked legitimate collateral backing, borrowing against them created potential shortfalls for lenders, similar to defrauding a traditional bank by depositing fake fiat and taking out loans against it, ultimately leaving the lender with bad debt. In response, protocols froze affected markets, while panicked users withdrew their funds, resulting in a sharp decline in total value locked. However, token prices have not moved as dramatically as deposits, with the AAVE token down approximately 2.5% over 24 hours, and UNI and LINK down less than 1% during the same period, according to CoinDesk market data. Peter Chung, head of research at Presto Research, noted that the incident highlights the risks associated with cross-chain infrastructure, particularly in the verification systems used by bridges. Initial analysis suggests that the issue may have originated in the verification layer rather than in the smart contracts themselves. Chung added that this episode demonstrates how interconnected DeFi protocols can transmit shocks beyond the initial point of failure, with withdrawal activity and market freezes extending to platforms without direct exposure to the exploit.