DeFi Faces $13 Billion Loss in 48 Hours Following KelpDAO Security Breach

A massive exodus of capital is currently underway in the decentralized finance sector, triggered by the recent exploitation of the KelpDAO protocol over the weekend. Aave, a prominent DeFi lending platform, has seen a staggering $8.45 billion withdrawal in deposits over the past two days, contributing to a broader decline of $13.21 billion in total value locked across the DeFi ecosystem. Total value locked, which measures the combined dollar value of crypto assets deposited across DeFi protocols, dropped from $99.497 billion to $86.286 billion. Aave's TVL alone plummeted by $8.45 billion to $17.947 billion during this period, according to data from DefiLlama. Protocol-level data reveals significant double-digit percentage drops in TVL across various platforms, including Euler, Sentora, and Aave, with the impact primarily felt in lending, restaking, and yield strategies tied to the affected collateral. The root cause of this decline stems from a $292 million exploit of Kelp's bridge, which allowed attackers to utilize stolen rsETH, a widely used liquid re-staking token in DeFi, as collateral to borrow funds on lending platforms. Since these stolen tokens lacked legitimate collateral backing, borrowing against them created potential shortfalls for lenders, akin to deceiving a traditional bank by depositing fake fiat and taking out loans against it, ultimately leaving the lender with bad debt. In response, protocols froze affected markets, while panicked users withdrew funds, leading to a broad decline in total value locked. However, token prices have been less affected, with the AAVE token experiencing a 2.5% decline over 24 hours, and UNI and LINK down less than 1% over the same period, according to CoinDesk market data. Peter Chung, head of research at Presto Research, noted that the incident highlights the risks inherent in cross-chain infrastructure, particularly in the verification systems used by bridges. Preliminary analysis suggests that the issue may have originated in the verification layer rather than in the smart contracts themselves. Chung also emphasized that this episode demonstrates how interconnected DeFi protocols can transmit shocks beyond the initial point of failure, with withdrawal activity and market freezes extending to platforms without direct exposure to the exploit.