In simply 48 hours, roughly $13 billion has been withdrawn from the DeFi market following the KelpDAO exploit on April 18—an incident now thought to be the most important decentralized finance hack of 2026. Past the direct lack of roughly $290 million, the occasion triggered an enormous wave of liquidity withdrawals that shortly unfold to lending protocols like Aave, the place a portion of the exploited property had been used as collateral.
DeFi TVL Drops $13B in 48 Hours
Information from DefiLlama exhibits that whole DeFi Complete Worth Locked (TVL) fell from roughly $99.4 billion to $86.2 billion, representing a drop of over $13 billion. Particularly, DeFi TVL on Ethereum plummeted from round $56.5 billion on April 18 to just about $46 billion in simply two days, equal to a virtually $10 billion decline inside this ecosystem alone.
Complete DeFi TVL chart. Supply: DefiLlama
The TVL decline was primarily pushed by liquidity withdrawals and the closing of positions associated to restaking and bridges, reasonably than spot market sell-offs—indicating that capital is exiting higher-risk constructions.
The occasion stemmed from a vulnerability in KelpDAO’s LayerZero-based rsETH bridge path, the place a “1-of-1 DVN” validation configuration allowed a fraudulent cross-chain message to be accepted with out a corresponding burn transaction. This flaw launched 116,500 rsETH from the Ethereum-side adapter, making a surplus of unbacked property on the related chains.
Kelp Exploit Triggers Liquidity Unwind
The direct harm of roughly $290 million from the exploit accounts for under a small fraction of the over $13 billion TVL drop throughout the market. The vast majority of the volatility stemmed from the next place unwinding course of.
rsETH is broadly used as collateral to borrow ETH or stablecoins, that are then additional deployed into different methods. When this asset encountered the exploit, these chains of associated positions had been compelled to shut to mitigate danger.
This course of led to liquidity withdrawals from lending protocols, diminished leverage, and defensive portfolio restructuring. Consequently, TVL dropped quickly, even earlier than compelled liquidations occurred on a big scale.
Information from Coinglass exhibits that whole liquidations in 24 hours reached roughly $254 million; whereas volatility elevated, it remained considerably decrease than in earlier panic liquidation occasions.
This implies that many of the capital leaving DeFi throughout this era got here from proactive deleveraging reasonably than compelled liquidations.
Aave Absorbs Many of the Market Shock
Aave grew to become the focus as a good portion of the exploited property was funneled into this lending system.
In keeping with a report printed by LlamaRisk on April 20, out of the entire 116,500 rsETH withdrawn, roughly 89,567 rsETH (~$221.39 million) was deposited into Aave as collateral. From there, the attacker borrowed roughly 82,650 WETH (~$190.86 million) together with a small quantity of wstETH, with positions sustaining well being components round 1.01–1.03—very near the liquidation threshold.
In response to this danger, Aave shortly froze all rsETH and wrsETH reserves and diminished the LTV (Mortgage-to-Worth) ratio to 0 to stop new positions from being opened. A number of associated WETH markets had been additionally frozen, whereas rate of interest fashions had been adjusted to alleviate liquidity strain throughout the system.
The protocol additionally confirmed that the system itself was not exploited and that the incident originated fully from exterior property.
Aave TVL chart. Supply: DefiLlama
Aave’s TVL dropped sharply following the incident, from roughly $26.3 billion to $20 billion in a brief interval, earlier than additional retreating to round $16.4 billion. Regardless of not being the positioning of the exploit, Aave grew to become the absorption level for a lot of the market strain as a consequence of its direct publicity to rsETH.
Unhealthy Debt Danger Ranges $120M–$230M
The potential unhealthy debt on Aave stays troublesome to find out exactly, because it depends upon how the unbacked rsETH is dealt with and the loss allocation mechanism.
In keeping with eventualities modeled within the LlamaRisk report, whole unhealthy debt on Aave may vary from roughly $123.7 million to $230.1 million, relying on whether or not losses are distributed evenly or focused on rsETH property on Layer 2s.
The influence degree could possibly be considerably greater on chains equivalent to Mantle, Arbitrum, and Base, the place liquidity is decrease, and place buffers are extra restricted.
Market at a Quick-Time period Inflection Level
Following the preliminary shock, positions associated to rsETH have largely been remoted on Aave and haven’t but recorded direct impacts on the protocol degree.
Nonetheless, capital continues to movement out of Aave, which holds the vast majority of the publicity associated to the exploited rsETH. If the worth of this asset continues to say no or if loss allocation creates additional strain on Layer 2 markets, the influence may unfold to collateral values and liquidity throughout the lending sector.
