DeFi Suffers $13 Billion Loss in 48 Hours Following KelpDAO Breach

A massive outflow of capital has hit the decentralized finance ecosystem after the KelpDAO protocol was exploited over the weekend. Aave, a leading DeFi lending platform, has seen $8.45 billion in deposits withdrawn in the past 48 hours, contributing to a broader decline of $13.21 billion in total value locked across DeFi protocols. The total value locked in DeFi has dropped from $99.497 billion to $86.286 billion, with Aave's TVL falling by $8.45 billion to $17.947 billion, according to DefiLlama. Many platforms, including Euler, Sentora, and Aave, have experienced double-digit percentage drops, with the losses mainly affecting lending, restaking, and yield strategies tied to the affected collateral. The issue began with a $292 million exploit of Kelp's bridge, which allowed attackers to use stolen rsETH as collateral to borrow funds on lending platforms. As these stolen tokens lacked legitimate collateral backing, borrowing against them created potential shortfalls for lenders, similar to a traditional bank being conned with fake fiat. In response, protocols have frozen affected markets, and panicked users have withdrawn funds, leading to a broad decline in total value locked. However, token prices have been less affected, with AAVE down around 2.5% over 24 hours, and UNI and LINK down less than 1% over the same period. According to Peter Chung, head of research at Presto Research, the incident highlights the risks in cross-chain infrastructure, particularly in verification systems used by bridges. Early analysis suggests that the issue may have originated in the verification layer rather than in the smart contracts themselves. Chung also noted that the episode demonstrates how interconnected DeFi protocols can transmit shocks beyond the initial point of failure, with withdrawal activity and market freezes extending to platforms without direct exposure to the exploit.