The weekend exploit of KelpDAO, resulting in a $290 million loss, was serious. Unlike typical smart contract bugs, the attack targeted a single-verifier setup in LayerZero's verification stack — a configuration Kelp had been repeatedly advised to upgrade. LayerZero preliminarily linked the incident to North Korea's Lazarus Group. The breach left rsETH, KelpDAO's liquid staking token, unbacked and sparked fears of contagion into lending markets, particularly Aave's WETH pool.
DeFi's total value locked (TVL) plunged roughly $13 billion in the aftermath, settling back to the mid-$80 billion range — about where it stood a year earlier. Aave alone saw $8.45 billion in outflows over 48 hours. Yet a $290 million theft does not directly cause a $13 billion decline unless a large portion of that TVL was reused collateral. Much of Aave's ETH exposure heading into the weekend was concentrated in looping strategies: users deposit liquid restaking tokens, borrow ETH, swap for more restaking tokens, and repeat. The same set of assets gets counted multiple times in TVL. That leverage inflates TVL on the way up and unwinds sharply during stress. The actual net capital loss is likely a fraction of the headline figure, though hard to isolate given how embedded these loops are.
Low yields bred the leverage bubble
Those strategies were partly a response to an already-broken yield environment. As of early April, Aave offered 2.61% APY on USDC deposits, below the 3.14% available on idle cash at Interactive Brokers. The risk premium that historically justified DeFi's complexity and smart contract exposure had largely disappeared. With organic yields insufficient, leverage filled the gap — and that concentration is what made the rsETH contagion so damaging. DefiLlama data shows rsETH balances on Aave had grown rapidly to nearly 580,000 tokens ($1.3 billion) in the weeks before the exploit, evidence that leverage buildup set the stage for a sharp unwind.
Crypto has survived worse
The “DeFi is dead” narrative resurfaces after every hack because failures are visible and immediate, while recovery is slower and less dramatic. But crypto has seen worse: Terra's collapse vaporized confidence across the sector; Wormhole and Ronin each lost roughly $1 billion; Multichain fell apart. “DeFi didn't die when Terra collapsed and caused billions in liquidations,” wrote a pseudonymous trader on X. “DeFi didn't die when Wormhole and Ronin were drained for around $1 billion. DeFi didn't die when Multichain bridge assets were stolen.” More recently, Bybit suffered a record ~$1.5 billion theft in February yet continued operating, processed a surge in withdrawals, restored reserves, and still handles billions in daily trading volume. DeFi is not dead — it has been tested and survived.