In simply 48 hours, roughly $13 billion has been withdrawn from the DeFi market following the KelpDAO exploit on April 18—an incident now thought to be the biggest decentralized finance hack of 2026. Past the direct lack of roughly $290 million, the occasion triggered an enormous wave of liquidity withdrawals that shortly unfold to lending protocols like Aave, the place a portion of the exploited belongings had been used as collateral.
DeFi TVL Drops $13B in 48 Hours
Information from DefiLlama reveals that whole DeFi Whole Worth Locked (TVL) fell from roughly $99.4 billion to $86.2 billion, representing a drop of over $13 billion. Particularly, DeFi TVL on Ethereum plummeted from round $56.5 billion on April 18 to almost $46 billion in simply two days, equal to an almost $10 billion decline inside this ecosystem alone.
Whole DeFi TVL chart. Supply: DefiLlama
The TVL decline was primarily pushed by liquidity withdrawals and the closing of positions associated to restaking and bridges, quite than spot market sell-offs—indicating that capital is exiting higher-risk buildings.
The occasion stemmed from a vulnerability in KelpDAO’s LayerZero-based rsETH bridge path, the place a “1-of-1 DVN” validation configuration allowed a fraudulent cross-chain message to be accepted and not using a corresponding burn transaction. This flaw launched 116,500 rsETH from the Ethereum-side adapter, making a surplus of unbacked belongings on the related chains.
Kelp Exploit Triggers Liquidity Unwind
The direct injury of roughly $290 million from the exploit accounts for less than a small fraction of the over $13 billion TVL drop throughout the market. Nearly all of the volatility stemmed from the following place unwinding course of.
rsETH is broadly used as collateral to borrow ETH or stablecoins, that are then additional deployed into different methods. When this asset encountered the exploit, these chains of associated positions had been pressured to shut to mitigate threat.
This course of led to liquidity withdrawals from lending protocols, diminished leverage, and defensive portfolio restructuring. Consequently, TVL dropped quickly, even earlier than pressured liquidations occurred on a big scale.
Information from Coinglass reveals that whole liquidations in 24 hours reached roughly $254 million; whereas volatility elevated, it remained considerably decrease than in earlier panic liquidation occasions.
This implies that a lot of the capital leaving DeFi throughout this era got here from proactive deleveraging quite than pressured liquidations.
Aave Absorbs A lot of the Market Shock
Aave turned the point of interest as a good portion of the exploited belongings was funneled into this lending system.
Based on a report printed by LlamaRisk on April 20, out of the full 116,500 rsETH withdrawn, roughly 89,567 rsETH (~$221.39 million) was deposited into Aave as collateral. From there, the attacker borrowed roughly 82,650 WETH (~$190.86 million) together with a small quantity of wstETH, with positions sustaining well being components round 1.01–1.03—very near the liquidation threshold.
In response to this threat, Aave shortly froze all rsETH and wrsETH reserves and diminished the LTV (Mortgage-to-Worth) ratio to 0 to forestall new positions from being opened. A number of associated WETH markets had been additionally frozen, whereas rate of interest fashions had been adjusted to alleviate liquidity strain throughout the system.
The protocol additionally confirmed that the system itself was not exploited and that the incident originated solely from exterior belongings.
Aave TVL chart. Supply: DefiLlama
Aave’s TVL dropped sharply following the incident, from roughly $26.3 billion to $20 billion in a brief interval, earlier than additional retreating to round $16.4 billion. Regardless of not being the positioning of the exploit, Aave turned the absorption level for a lot of the market strain resulting from its direct publicity to rsETH.
Dangerous Debt Danger Ranges $120M–$230M
The potential dangerous debt on Aave stays tough to find out exactly, because it is dependent upon how the unbacked rsETH is dealt with and the loss allocation mechanism.
Based on eventualities modeled within the LlamaRisk report, whole dangerous debt on Aave might vary from roughly $123.7 million to $230.1 million, relying on whether or not losses are distributed evenly or targeting rsETH belongings on Layer 2s.
The influence degree may very well be considerably increased on chains comparable to Mantle, Arbitrum, and Base, the place liquidity is decrease, and place buffers are extra restricted.
Market at a Brief-Time period Inflection Level
Following the preliminary shock, positions associated to rsETH have largely been remoted on Aave and haven’t but recorded direct impacts on the protocol degree.
Nonetheless, capital continues to stream out of Aave, which holds nearly all of the publicity associated to the exploited rsETH. If the worth of this asset continues to say no or if loss allocation creates additional strain on Layer 2 markets, the influence might unfold to collateral values and liquidity throughout the lending sector.
