The decentralized finance (DeFi) ecosystem is experiencing dramatic capital outflows after the KelpDAO protocol was exploited over the weekend.
Aave, the leading DeFi lending platform, lost $8.45 billion in deposits in the past 48 hours, causing the total value locked (TVL) across DeFi to drop by $13.21 billion. TVL refers to the total dollar value of crypto assets deposited through DeFi protocols such as Aave and is widely used to measure liquidity and overall market activity.
According to DefiLlama, the total value locked in DeFi as a whole fell from $99.497 billion to $86.286 billion, while Aave’s total locked value fell by $8.45 billion to $17.947 billion during the same period. Protocol-level data shows that platforms including Euler, Sentora and Aave saw double-digit percentage declines, with losses concentrated on lending, re-hypothecation and yield strategies tied to affected collateral.
The move follows a $292 million vulnerability in Kelp Bridge that allowed attackers to use stolen rsETH, a liquidity re-hypothecation token widely used in DeFi, as collateral to borrow funds on the lending platform.
Since these stolen tokens lack legal collateral, borrowing against them could create a potential shortfall for lenders. This is similar to defrauding traditional banks by depositing fake fiat currency and withdrawing loans against it, ultimately leaving the lender with bad debts.
The protocol responded by freezing affected markets, while panicked users withdrew funds, causing the total value locked to plummet.
Token prices fluctuate less than deposits. The AAVE token fell about 2.5% in 24 hours, while UNI and LINK fell less than 1% in the same period, according to CoinDesk market data.
Peter Chung, research director at Presto Research, said in a report that the incident highlights risks in cross-chain infrastructure, especially in the verification systems used by bridges.
Early analysis suggests that the problem may stem from the verification layer rather than the smart contract itself.
Chung added that the incident also shows how interconnected DeFi protocols can transmit shocks beyond the initial point of failure, with withdrawal activity and market freezes extending to platforms not directly exposed to the vulnerability.
