The most straightforward assessment following the $290 million exploit and the roughly $13 billion decline in DeFi's total value locked is that decentralized finance has once again failed. However, this perspective is likely oversimplified.
The KelpDAO exploit, which occurred over the weekend, was indeed severe. It appears to have originated from a targeted attack on the infrastructure utilized in LayerZero's verification stack, rather than a smart contract bug, which is more commonly seen in other exploits. LayerZero has preliminarily attributed the incident to North Korea's Lazarus Group and stated that the attack succeeded due to Kelp's decision to use a single-verifier setup, despite repeated recommendations to adopt a more resilient configuration.
The exploit resulted in rsETH, a liquid staking token issued by KelpDAO, becoming unbacked, triggering concerns that bad debt would spill into lending markets, particularly Aave's WETH pool. Nonetheless, the more intriguing narrative is not the fact that DeFi was impacted, but rather that it continues to endure. Capital rapidly exited the market following the breach, with Aave alone experiencing $8.45 billion in outflows over 48 hours, while DeFi's broader TVL dropped to the mid-$80 billion range, roughly returning to its level from the same period last year. In essence, this was a sharp reevaluation of risk rather than a disastrous event.
Aave, the largest DeFi lending market, had accumulated significant rsETH as collateral in the weeks leading up to the exploit, as users built leveraged positions. The scale of the TVL decline also warrants some context, as a $292 million theft does not directly lead to a $13 billion decline unless a substantial portion of that TVL was already recycled collateral. Much of Aave's ETH exposure heading into the weekend was concentrated in looping strategies, where users deposit liquid restaking tokens, borrow ETH against them, swap for more restaking tokens, and repeat. In other words, the same pile of assets may be counted multiple times in the TVL calculation, causing the leverage to inflate TVL during growth periods and unwind sharply during events like this.
The actual net capital loss is likely a fraction of the headline figure, although the exact amount is challenging to isolate due to the deep embedding of looping strategies in DeFi's TVL calculations. Those strategies were partly a product of a yield environment that had already ceased to make sense. As of early April, Aave was offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers, a traditional financial brokerage.
The risk premium that historically justified DeFi's complexity and smart contract exposure had largely disappeared. With organic yield being insufficient, leverage filled the gap, and this concentration is what made the rsETH contagion as damaging as it was. Data from DefiLlama shows that reETH balances on Aave had grown rapidly in the weeks leading up to the exploit, reaching nearly 580,000 tokens ($1.3 billion), providing evidence that the leverage buildup made the subsequent unwind so sharp.
The cryptocurrency space has endured worse catastrophes. The phrase 'DeFi is dead' is often repeated after every hack because the failures are visible and immediate, while the recovery is slower and less dramatic. However, the sector has survived worse incidents, such as the collapse of Terra, which vaporized confidence across the sector, and the losses suffered by Wormhole and Ronin, which totaled roughly $1 billion each. More recently, Bybit experienced what was widely described as the largest crypto theft on record, losing around $1.5 billion in February, yet it continued operating and restored its reserves.
The repricing of trust is a significant but not existential issue. 0xNGMI, founder of DefiLlama, told CoinDesk that the losses are substantial but unlikely to be catastrophic.
'Aave has many resources to cover the loss, including its treasury and taking loans, and I think those will have to be used to protect the protocol,' he said. 'Overall, a significant loss but one that will be recovered.
The biggest issue will be the impact on risk premiums that are assigned to DeFi.' Those risk premiums are a real and lasting cost, as capital will demand more compensation for participating in on-chain systems whose attack surface now extends beyond code. Still, repricing is not the same as collapse. 'Some of the money will come back,' 0xNGMI said.
'We saw this before in Aave when rumors of a hack appeared. It's always the best strategy to withdraw and redeposit later, as the cost of that is tiny and the reward very large.' Some deposits will not return, but historically, deposit outflows during stress events reverse as conditions stabilize, as seen after Terra's collapse in 2021. There is also evidence that capital is not simply leaving DeFi but instead rotating. Spark offers one example, as its strategy lead, monetsupply.eth, stated that the protocol delisted rsETH and other low-utilization assets in January, a move that may have cost it business and ETH-looping activity to Aave at the time.
Under current conditions, however, SparkLend still has ample ETH withdrawal liquidity, while Aave is experiencing shortages across several markets. Over the weekend, Spark's TVL jumped from $1.8 billion to $2.9 billion, demonstrating clear capital rotation. The more interesting critique, raised by some builders after the exploit, is not that DeFi failed but that it has become too timid.
If the sector is going to ask users to bear infrastructure risk, smart contract risk, and governance risk for low single-digit yields, the product set starts to look less compelling. With that in mind, Kelp is not the end of DeFi; it is a wake-up call for builders to construct safer systems while continuing to offer real-world use cases.