DeFi Losses Exceed $600 Million Following Kelp DAO Exploit, Resulting in One-Year Low for Total Value Locked

The Kelp DAO exploit on April 18, 2026, where attackers generated 116,500 uncollateralized rsETH by compromising a single LayerZero verifier node, has triggered over $600 million in losses across the DeFi sector in recent weeks, with total damages across various protocols nearing $1 billion.

The repercussions are now evident on-chain: the total value locked in DeFi has plummeted to its lowest level in a year, according to DefiLlama data, as capital exits rapidly from restaking, lending, and cross-chain bridge protocols.

The primary issue raised is not whether Kelp DAO failed—this is clear from an architectural standpoint—but whether a single misconfigured verifier has revealed a systemic vulnerability underlying the entire cross-chain DeFi framework.

Key Takeaways:

• Total DeFi losses: Roughly $1 billion in recent weeks, with over $600 million directly linked to the Kelp DAO exploit and its cascading effects.
• Kelp DAO exploit scale: 116,500 uncollateralized rsETH minted—approximately 18% of the circulating supply—through a compromised LayerZero DVN node; no breach of smart contracts occurred.
• TVL impact: The total value locked in DeFi has reached a one-year low following a $13 billion outflow within 48 hours of the exploit.
• Protocols affected: Aave, SparkLend, and Fluid all suspended rsETH markets; Aave’s TVL decreased from $26.4 billion to about $18 billion, marking the largest loss for a single protocol.
• Attribution: LayerZero has identified North Korea’s Lazarus Group—specifically the TraderTraitor subgroup—as the likely attackers; this has not yet been formally confirmed.
• Key watch item: The upcoming forensic report from Kelp DAO and Aave’s resolution of bad debt related to compromised rsETH collateral will be critical indicators of whether the contagion stabilizes or worsens.

Discover: The best crypto to diversify your portfolio with

How a Single Verifier Node Took Down $600M in DeFi

The failure was architectural rather than foundational, and this distinction is significant for evaluating the remainder of DeFi’s cross-chain infrastructure. Kelp DAO’s rsETH bridge depended on a single Decentralized Verifier Network node to validate LayerZero messages, a 1-of-1 setup that security firm Halborn had previously highlighted in warnings.

The attackers, identified by LayerZero as part of Lazarus Group’s TraderTraitor subgroup, compromised two RPC nodes supplying data to that verifier, executed DDoS attacks on backup nodes to force a failover, and then sent a fraudulent message that minted 116,500 rsETH without any underlying collateral.

The stolen rsETH was quickly moved. On-chain data indicates the attacker exchanged it for ETH and Arbitrum using loans from Aave, SparkLend, and Fluid, with Tornado Cash utilized for gas fee obfuscation. Malware was removed from the compromised RPCs after the attack, intentionally deleting forensic logs. For further details on how LayerZero attributed the attack, the mechanics of the RPC poisoning sequence are thoroughly documented.

Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.
We are working with @LayerZero_Core, @unichain, our auditors and top security experts on RCA.
We will keep you…

— Kelp (@KelpDAO) April 18, 2026

Losses accumulated rapidly. The 116,500 minted rsETH created bad debt across lending markets that had accepted rsETH as collateral without sufficient verification of its backing, creating an “echo chamber” for forged messages, as Halborn described. Allium, examining the verification gap after the incident, noted that “the tools functioned as intended. The configuration was flawed.”

This is not a trivial detail: it indicates that the exploit did not rely on a zero-day vulnerability, but rather on a misconfiguration that had been documented and warned about beforehand.

Single-point-of-failure verifier architectures are now recognized as a potential attack surface, and Kelp DAO is unlikely to be the last protocol employing such a design.

TVL at a One-Year Low: What the Capital Flight Data Actually Signals

The aggregate TVL in DeFi had already been declining through Q1 2026 due to macroeconomic pressures, but the Kelp DAO exploit intensified the downturn into a steep decline.

DefiLlama data reveals a $13 billion TVL exodus within 48 hours following the April 18 attack, a pace that caught protocols like Compound off guard, which had no direct exposure to rsETH but still experienced contagion-related withdrawals.

The losses for individual protocols are even more pronounced. Aave’s TVL fell from $26.4 billion to around $18 billion after the protocol suspended rsETH markets, resulting in an $8.45 billion decline driven by users de-risking ahead of potential bad debt from compromised collateral positions.

Money is leaving DeFi at an unprecedented scale pic.twitter.com/bZ3m40wfs4

— wale.moca (@waleswoosh) April 20, 2026

Aave’s risk management team is currently modeling two bad debt scenarios based on recovery rates for the uncollateralized rsETH that was used as loan collateral prior to the freezing of markets.

The compression of TVL sets up two distinct future scenarios. If outflows stabilize and Kelp releases a credible forensic report along with a compensation mechanism, the current level may turn out to be a localized contagion, unpleasant but contained. Conversely, if Aave’s bad debt modeling reveals significant losses and LayerZero’s multi-DVN upgrade timeline extends beyond Q2, a further decline in TVL is anticipated as yield seekers shift entirely away from restaking protocols to less interconnected alternatives.

Governance token valuations are already reflecting the first scenario as overly optimistic; AAVE has dropped over 20% since the exploit, and the recovery narrative hinges entirely on Aave’s ability to resolve its rsETH exposure effectively.

Discover: The best pre-launch token sales

The post DeFi Losses Surpass $600M as Kelp DAO Exploit Pushes TVL to One-Year Low appeared first on Cryptonews.