The recent $290 million exploit and the subsequent $13 billion slide in DeFi's total value locked have led many to proclaim that decentralized finance is broken. However, this take is not only lazy but also misguided.
The KelpDAO exploit, which was linked to North Korea's Lazarus Group, was a serious incident, but it was not a result of a smart contract bug. Instead, it was a targeted attack on LayerZero's verification stack, which was made possible by Kelp's decision to use a single-verifier setup despite repeated recommendations to use a more resistant configuration. The exploit left rsETH unbacked and triggered fears of bad debt spilling into lending markets. However, the more interesting story is not the exploit itself, but the fact that DeFi is still standing.
Capital fled quickly after the breach, with Aave experiencing $8.45 billion in outflows over 48 hours, and broader DeFi TVL falling to the mid-$80 billion range. This was a sharp repricing of risk, but not as destructive as some have made it out to be.
Aave, the largest DeFi lending market, had accumulated significant rsETH as collateral in the weeks before the exploit, and the scale of the TVL drop warrants some context. The $292 million theft did not directly produce a $13 billion decline, unless a meaningful portion of that TVL was already recycled collateral. Much of Aave's ETH exposure heading into the weekend was concentrated in looping strategies, where users deposit liquid restaking tokens, borrow ETH against them, swap for more restaking tokens, and repeat. This leverage inflates TVL on the way up and unwinds sharply during events like this.
The actual net capital loss is likely a fraction of the headline figure, though the exact amount is difficult to isolate. Those strategies were partly a product of a yield environment that had already stopped making sense. As of early April, Aave was offering 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers. The risk premium that historically justified DeFi's complexity and smart contract exposure had largely disappeared.
With organic yield insufficient, leverage filled the gap, and that concentration is what made the rsETH contagion as damaging as it was. Data from DefiLlama shows that reETH balances on Aave had grown rapidly in the weeks leading up to the exploit, reaching nearly 580,000 tokens ($1.3 billion), evidence that the leverage buildup made the subsequent unwind so sharp.
Crypto has survived worse, including the collapse of Terra, which vaporized confidence across the sector, and the losses of Wormhole and Ronin, which lost roughly $1 billion each. Despite these incidents, DeFi did not die. More recently, Bybit suffered a massive crypto theft, losing around $1.5 billion, yet it continued operating and restored reserves. The repricing of trust is a real and lasting cost, with capital demanding more compensation for sitting in on-chain systems whose attack surface now extends beyond code.
However, repricing is not the same thing as collapse. Some of the money will come back, and historically, deposit outflows during stress events reverse as conditions stabilize. There is also evidence that capital is not simply leaving DeFi, but rotating. Spark's TVL jumped from $1.8 billion to $2.9 billion over the weekend, demonstrating clear capital rotation.
The more interesting critique is not that DeFi failed, but that it has become too timid. If the sector is going to ask users to bear infrastructure risk, smart contract risk, and governance risk for low single-digit yields, the product set starts to look less compelling.
With that in mind, Kelp is not the end of DeFi, but a wake-up call for builders to build safer systems while continuing to offer real-world use cases.