DeFi Losses Pass $600M in Three Weeks With Kelp DAO Bridge Exploit

Crypto News

The decentralized finance sector has absorbed more than $600 million in losses over the past three weeks, driven by a string of platform exploits. The most recent and largest came Saturday, when an attacker drained $292 million from Kelp DAO’s cross-chain bridge, sending sector-wide metrics to their lowest point in a year.

Total value locked across DeFi fell to approximately $82.4 billion, down 25% from the $110 billion recorded at the start of 2026. The day following the Kelp DAO exploit, DeFi posted a single-session drawdown of about 5.6%. That places the move near the 98th percentile of severity since 2024.

Lending markets bore the steepest losses, with TVL falling around 13%. Liquid staking declined roughly 3.4%, while decentralized exchanges and derivatives protocols each dropped between 2% and 3%. Crypto security firm Halborn separately estimated that $86 million was lost to DeFi attacks in January, $23.5 million in February, and over $27 million in March.

The $292 million Kelp DAO incident followed a roughly $285 million exploit of Drift Protocol earlier this month, which stands as the largest Solana-based hack on record. Smaller breaches at Resolv Labs, Hyperbridge, and Rhea Finance added to the cumulative total.

The Kelp DAO attacker manipulated a cross-chain message to drain rsETH from a bridge powered by LayerZero. The stolen assets were then deposited as collateral on Aave, pulling the lending protocol into the fallout. Preliminary findings from security researchers have linked the attack to the North Korean hacking group Lazarus.

Aave froze rsETH on its platform to contain further exposure. The move left some stablecoin markets short on available liquidity and locked up billions in user deposits. Blockchain analytics firm Arkham Intelligence outlined two scenarios for distributing the losses. One would spread them evenly across all rsETH holders at roughly 16% each. The other would fully protect <a href="https://xpertsstudio.com/ethereum-rallies-30-after-sentiment-hits-three-month-low/” title=”Ethereum Rallies 30% After Sentiment Hits Three-Month Low”>Ethereum mainnet users, placing most of the burden on layer-2 holders, with Aave users potentially absorbingup to $267 million.
LayerZero said in a Monday post on X that the exploit resulted from Kelp DAO’s choice to use a single verification setup for its bridge, callingit a “single point of failure.” It added that no other integrations were affected. The statement did not ease tensions between the three protocols. Yearn Finance core developer Banteg wrote on X that all three parties had retained lawyers and were engaged in open conflict. “We should get LayerZero, Kelp, Aave into a room to figure things out,” he wrote. “So far things are not looking good, everyone has lawyered up and going full PvP on each other.”
This article contains links to third-party websites or other content for information purposes only (“Third-Party Sites”). The Third-Party Sites are not under the control of CoinMarketCap, and CoinMarketCap is not responsible for the content of any Third-Party Site, including without limitation any link contained in a Third-Party Site, or any changes or updates to a Third-Party Site. CoinMarketCap is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement, approval or recommendation by CoinMarketCap of the site or any association with its operators. This article is intended to be used and must be used for informational purposes only. It is important to do your own research and analysis before making any material decisions related to any of the products or services described. This article is not intended as, and shall not be construed as, financial advice. The views and opinions expressed in this article are the author’s [company’s] own and do not necessarily reflect those of CoinMarketCap.

Source: coinmarketcap.com