The decentralized finance (DeFi) ecosystem is experiencing heavy capital flight following the weekend exploit of the KelpDAO protocol.
Aave, the leading DeFi lending platform, lost $8.45 billion in deposits over the past 48 hours, leading to a broader $13.21 billion drop in total value locked (TVL) in DeFi. TVL refers to the combined monetary value of crypto assets deposited via DeFi protocols, such as Aave, and is widely used to measure liquidity and overall market activity.
The total value locked in DeFi increased from $99.497 billion to $86.286 billion, while Aave’s TVL decreased from $8.45 billion to $17.947 billion during the same period, according to DefiLlama. Protocol-level data shows double-digit percentage declines across all platforms, including Euler, Sentora, and Aave, with losses concentrated in lending, staking, and yield strategies tied to the affected collateral.
The move stems from a $292 million Kelp Bridge exploit that allowed attackers to use stolen rsETH, a liquid re-staking token widely used in DeFi, as collateral to borrow funds on lending platforms.
Since these stolen tokens did not have legitimate collateral, borrowing against them created potential deficits for lenders. It’s like defrauding a traditional bank by depositing fake fiat currencies and taking out loans against it, ultimately leaving the lender with uncollectible debts.
The protocols responded by freezing affected markets as panicked users withdrew their funds, leading to a large drop in the total value blocked.
Token prices have moved less strongly than deposits. The AAVE token is down about 2.5% over 24 hours, while UNI and LINK are down less than 1% over the same period, according to CoinDesk market data.
Peter Chung, head of research at Presto Research, said in a note that the incident highlights risks in cross-chain infrastructure, particularly in the verification systems used by bridges.
Early analysis suggests the problem may lie with the verification layer rather than the smart contracts themselves.
Chung added that the episode also shows how interconnected DeFi protocols can transmit shocks beyond the initial point of failure, with withdrawal activity and market freezes extending to platforms without direct exposure to the exploit.
