The Decentralized Finance (DeFi) sector has been hit by a major shockwave. In just two days, Aave, the leading crypto lending protocol, saw over a third of its Total Value Locked (TVL) vanish. The mass exodus of investors was triggered by a hack of the liquid restaking protocol Kelp DAO, sparking a domino effect across the entire ecosystem.
Plunging Metrics: The Facts and Figures
According to DefiLlama, the total value of assets on Aave plummeted from $26.3 billion to $17.7 billion. Alongside the liquidity drain, the market reacted with a sharp price correction:
- AAVE Token Price: Dropped by more than 15%, hitting the $91 mark.
- Market Capitalization: Shrank by half a billion dollars — from $1.8 billion down to $1.3 billion.
The situation is further complicated by a “liquidity crunch” within the protocol itself. In Aave v3, the USDT and USDC pools are completely exhausted. Currently, $5.1 billion in assets are frozen — users cannot withdraw their funds until new liquidity enters the system or borrowers repay their loans.
Timeline of the Attack: From Bridge Exploit to “Toxic” Collateral
The root cause of the turmoil was a breach of the Kelp DAO cross-chain bridge, built on LayerZero technology, which occurred on April 18.
- The Theft: Hackers drained 116,500 rsETH (approximately $293 million).
- Manipulation: The attackers deposited the stolen tokens into Aave v3 as collateral to borrow “clean” assets, specifically wETH.
- Scale: The total value of the hackers’ positions across Aave, Compound, and Euler reached roughly $236 million.
Curve Finance founder Michael Egorov described the situation as critical. According to him, Aave is trapped: its balance sheet is weighed down by illiquid rsETH tokens that cannot be sold, while its ETH reserves have been entirely drained by borrowers.
“Aave has rsETH that it can’t sell, and it has no ETH because it’s all out in loans. No one can withdraw Ethereum,” Egorov noted.
Market Reaction and Emergency Measures
The Aave team initially promised to cover any deficit via the Umbrella reserve fund; however, they later softened their stance, stating they are “exploring paths for compensation.” Currently, the following measures have been implemented:
- rsETH markets in versions v3 and v4 have been frozen.
- wETH reserves are locked across Ethereum, Arbitrum, Base, Mantle, and Linea.
- Several major projects (Curve, Ethena) have suspended interactions with the Kelp DAO bridge.
The echoes of the hack reached the Solana ecosystem as well. In the Kamino protocol, USDC reserves totaling $178 million were completely depleted due to a sudden surge in demand, causing deposit rates to skyrocket to extreme levels. Overall, the TVL of the entire DeFi sector fell from $99.4 billion to $85.8 billion.
LayerZero Investigation: Who is Responsible?
LayerZero developers attributed the attack to the North Korean hacking group TraderTraitor (a unit of Lazarus), previously linked to the high-profile exploits of Ronin and Drift Protocol.
Technical Aspect of the Exploit
The investigation revealed that the hackers utilized “RPC server poisoning.” They gained access to a list of servers used by the Decentralized Verified Network (DVN) and forced the system to accept a fraudulent cross-chain message. To prevent legitimate servers from flagging the forgery, the attackers paralyzed them with a DDoS attack.
Experts emphasize that the tragedy was avoidable. Kelp DAO utilized a simplified 1/1 DVN security scheme, ignoring LayerZero’s recommendations to diversify verifiers. This “single point of failure” allowed the hackers to unlock the tokens without resistance.
Conclusion
The Kelp and Aave incident once again highlights the systemic risks associated with using Liquid Staking/Restaking Tokens (LST/LRT) as collateral. While law enforcement and analysts track the stolen funds, the DeFi community must address a primary challenge: how to restore liquidity and user trust in the industry’s largest lending platforms.
