DeFi Suffers $13 Billion Loss in 48 Hours Following KelpDAO Breach

A recent exploit of the KelpDAO protocol has triggered a substantial outflow of capital from the decentralized finance ecosystem. Over the past two days, Aave, a prominent DeFi lending platform, has experienced a decline of $8.45 billion in deposits, contributing to a broader $13.21 billion decrease in total value locked across DeFi. The total value locked, which measures the combined dollar value of crypto assets deposited across DeFi protocols, has dropped from $99.497 billion to $86.286 billion. Aave's TVL has decreased by $8.45 billion to $17.947 billion over the same period, according to DefiLlama. Several platforms, including Euler, Sentora, and Aave, have reported double-digit percentage declines, primarily in lending, restaking, and yield strategies tied to the affected collateral. The decline is attributed to a $292 million exploit of Kelp's bridge, which allowed attackers to use stolen rsETH as collateral to borrow funds on lending platforms. As the stolen tokens lacked legitimate collateral backing, borrowing against them created potential shortfalls for lenders. In response, protocols have frozen affected markets, and panicked users have withdrawn funds, resulting in a broad decline in total value locked. However, token prices have been less affected, with the AAVE token down approximately 2.5% over 24 hours, and UNI and LINK down less than 1% over the same period. According to Peter Chung, head of research at Presto Research, the incident highlights the risks associated with cross-chain infrastructure, particularly in verification systems used by bridges. Early analysis suggests that the issue may have originated in the verification layer rather than in smart contracts themselves. Chung also noted that the episode demonstrates how interconnected DeFi protocols can transmit shocks beyond the initial point of failure, with withdrawal activity and market freezes extending to platforms without direct exposure to the exploit.