DeFi TVL Slides $13.21B in Two Days After KelpDAO Exploit Triggers Withdrawals
A weekend exploit involving KelpDAO has sparked a rapid pullback across decentralized finance, with users and protocols moving to limit exposure.
Over the past 48 hours, Aave recorded $8.45 billion in net deposit outflows, helping push DeFi's total value locked (TVL) down by $13.21 billion, according to DefiLlama. TVL—the dollar value of crypto assets deposited across DeFi protocols—is a widely watched gauge of liquidity and activity.
DefiLlama data shows aggregate DeFi TVL fell to $86.286 billion from $99.497 billion. Aave's TVL dropped by $8.45 billion to $17.947 billion over the same window. Protocol-level figures point to double-digit percentage declines across several platforms, including Euler, Sentora and Aave, with the steepest losses tied to lending, restaking and yield strategies linked to the affected collateral.
The disruption traces back to a $292 million exploit of Kelp's bridge. Attackers obtained rsETH—a liquid restaking token commonly used across DeFi—and used the stolen tokens as collateral to borrow from lending venues. Because the rsETH was not backed by legitimate collateral, the borrowing activity created potential shortfalls for lenders, akin to using counterfeit fiat deposits to secure real bank loans and leaving creditors with bad debt.
In response, protocols froze impacted markets and users rushed to withdraw funds, accelerating the decline in TVL.
Token prices have been less reactive than deposits. AAVE was down about 2.5% over 24 hours, while UNI and LINK each fell less than 1%, based on CoinDesk market data.
Peter Chung, head of research at Presto Research, said the episode underscores vulnerabilities in cross-chain infrastructure, particularly bridge verification systems. Early assessments suggest the failure may have occurred in the verification layer rather than in the smart contracts themselves. Chung also noted that DeFi's interconnected structure can propagate shocks beyond the original point of failure, with withdrawals and market freezes reaching platforms without direct exposure to the exploit.
