DeFi Lost $14 Billion in Two Days After the Kelp Exploit and TVL Hit Its Lowest Level in a Year

DeFi's total value locked dropped from roughly $99 billion to $85 billion between April 18 and April 20, the sharpest two-day decline in over a year. The trigger was a $292 million exploit of Kelp DAO, a liquid restaking protocol whose rsETH token was embedded as collateral across at least nine separate lending markets. When the attacker drained Kelp's bridge contract, rsETH lost its peg, and the collateral backing billions in DeFi loans evaporated in hours. Aavealone saw $6.6 billion in withdrawals as users scrambled to pull funds before contagion spread further.

The number that should keep every DeFi user awake is not $292 million but rather 15 months, which is how long ago CryptoTimes reported that LayerZero engineers flagged Kelp DAO's single-validator bridge architecture as a critical vulnerability. Kelp acknowledged the warning and did nothing.

How the Kelp Exploit Actually Worked

The attacker targeted Kelp DAO's cross-chain bridge, which used a single validator to confirm transactions between Ethereum mainnet and the protocol's restaking layer. LayerZero's security team had warned in January 2025 that this architecture created a single point of failure, and one compromised validator key meant total bridge control.

On April 18, the attacker exploited exactly that weakness. They gained access to the validator key through what early forensic reports describe as a social engineering attack on a Kelp team member, then minted unbacked rsETH on Ethereum mainnet. The minted tokens were immediately deposited into lending protocols as collateral to borrow ETHand stablecoins, which were then bridged out through multiple chains before Kelp's monitoring systems triggered an alert.

The total extraction was $292 million, but the damage extended far beyond that figure because rsETH functioned as foundational infrastructure across the DeFi lending stack, not a standalone token sitting in isolation.

Why $292 Million Caused $14 Billion in Damage

The exploit's true impact had nothing to do with the amount stolen and everything to do with where rsETH sat in the DeFi stack.

Liquid restaking tokens like rsETH are designed to be composable. You stake ETH, receive rsETH, then use that rsETH as collateral in lending protocols to borrow more assets. The yield stacks, the capital efficiency improves, and the systemic risk multiplies with every additional layer of leverage.

When the exploit broke rsETH's peg, nine protocols froze their rsETH markets simultaneously. Borrowers who had used rsETH as collateral faced immediate liquidation or, worse, discovered they could not exit positions because markets were frozen. The fear was entirely rational because if rsETH could lose its peg due to unbacked minting, any position collateralized by rsETH was effectively unsecured.

Aave absorbed the largest single-protocol impact. Users withdrew $6.6 billion in 36 hours, not because Aave itself was exploited, but because depositors no longer trusted that rsETH collateral backing their counterparties' loans was worth what the oracle said it was. The bank run logic was textbook, and when you cannot verify collateral quality, you pull your capital first and ask questions later.

The remaining protocols acted within hours, and by April 20, DeFi TVL had fallen to approximately $85 billion. That puts it roughly 50% below the October 2025 peaks and at the lowest TVL reading since April 2025.

The 15-Month Warning That Kelp Ignored

This is the part of the story that transforms a hack into a governance failure.

In January 2025, LayerZero's cross-chain security team published an internal assessment of liquid restaking bridges, including Kelp's. The CryptoTimes investigation revealed that LayerZero specifically flagged the single-validator bridge setup as "critically insufficient for securing assets above $50 million." Kelp's bridge at that point held roughly $180 million.

LayerZero recommended a multi-signature validator set with a minimum of five independent validators and a 3-of-5 threshold for confirming cross-chain transactions. The recommendation included technical specifications and an offer to assist with implementation. Kelp's engineering team acknowledged receipt of the report in February 2025.

Fifteen months later, the bridge still operated with a single validator because no multi-sig was ever implemented and no alternative security layer was added. The protocol grew from $180 million to over $400 million in TVL during that period, all secured by the same architecture that had been flagged as inadequate for one-third of that amount.

The DeFi community's response has been predictable and justified. Calls for mandatory security audit disclosure, bridge insurance requirements, and minimum validator thresholds are now dominating governance forums across every major lending protocol. But the uncomfortable truth is that these are the same proposals that circulated after the Wormhole exploit in 2022 and the Multichain collapse in 2023. The industry keeps having the same conversation after every bridge failure.

What the TVL Drop Tells You About DeFi Risk Right Now

The $85 billion TVL number is significant for reasons beyond the headline shock.

DeFi TVL peaked near $170 billion in October 2025 during the restaking and liquid staking boom. The decline to $99 billion before the Kelp exploit was already a 42% drawdown driven by broader market weakness and reduced yield farming activity. The Kelp exploit accelerated that decline by another 14% in two days, pushing TVL to a level not seen since the market was recovering from the 2024 bear market bottom.

The composition of the outflows matters as much as the total. According to DeFiLlama's protocol flow data, the largest withdrawals came from lending protocols (Aave, Compound, Euler), not from DEXs or yield aggregators. That pattern tells you this is a collateral confidence crisis, not a liquidity crisis. Traders are still willing to swap tokens on Uniswap and Curve. They are not willing to lend those tokens into pools where the collateral quality is uncertain.

For context, TVL dropped roughly $30 billion after the Terra/Luna collapse in May 2022. The Kelp-driven $14 billion drop in raw numbers is smaller, but as a percentage of the starting base it represents a comparable shock. And the mechanism is eerily similar. A token that was supposed to maintain its peg lost it, and every protocol that had integrated that token as collateral suffered cascading failures.

What DeFi Protocols Are Doing Now

The response across major protocols has moved beyond emergency freezes into structural changes.

Aave's governance forum currently has three active proposals. The first would cap any single liquid staking derivative at 15% of total protocol collateral. The second would require all accepted collateral tokens to maintain bridge insurance coverage above a minimum threshold. The third would mandate quarterly external bridge audits for any cross-chain collateral type, with automatic delisting if audits are not published on schedule.

MakerDAO's Spark protocol has gone further, announcing that it will no longer accept any liquid restaking token as primary collateral unless the underlying bridge uses a minimum 5-of-9 multi-sig validator set. That standard would currently disqualify the majority of liquid restaking tokens on the market.

Compound's emergency governance vote passed within 18 hours of the exploit, the fastest governance action in the protocol's history. The vote permanently delisted rsETH and added a mandatory 72-hour security review period for any new collateral type, up from the previous 48-hour window.

These are meaningful changes, but they are reactive. The pattern in DeFi has always been the same. An exploit exposes a systemic risk that was visible beforehand, protocols patch the specific vulnerability, and the next exploit hits a different vector that nobody patched because it had not been exploited yet.

Frequently Asked Questions

What caused DeFi TVL to drop $14 billion in two days?

A $292 million exploit of Kelp DAO's bridge contract caused rsETH to lose its peg. Because rsETH was used as collateral across nine major lending protocols, the broken peg triggered mass withdrawals as depositors lost confidence in collateral quality. Aave alone saw $6.6 billion pulled out in 36 hours.

Was the Kelp exploit preventable?

By all available evidence, yes, it was entirely preventable. LayerZero flagged the single-validator bridge architecture as critically insufficient 15 months before the exploit occurred. They recommended a multi-signature validator set. Kelp acknowledged the warning but never implemented the fix, even as the protocol's TVL grew from $180 million to over $400 million.

Is DeFi TVL likely to recover quickly?

Recovery depends on how fast lending protocols implement new collateral standards that restore depositor confidence and on broader market conditions. TVL is now roughly 50% below October 2025 peaks, and the collateral crisis adds a trust deficit on top of the existing market drawdown. Historical parallels like the Terra collapse suggest TVL recovers over months, not weeks.

Should I withdraw my funds from DeFi lending protocols?

The risk is concentrated in protocols that still hold liquid restaking tokens as collateral without updated security standards. Protocols that have already frozen or delisted rsETH and implemented stricter collateral requirements (Aave, Compound, Spark) have addressed the immediate vulnerability. Check which collateral types your deposited assets are being lent against before making a decision.

Bottom Line

DeFi just experienced its worst collateral crisis since Terra/Luna, and the most damning detail is not the $292 million stolen but the fact that the exact vulnerability was documented, reported to the team, and ignored for 15 months while the protocol tripled in size. TVL at $85 billion is now at a 12-month low, and the trust deficit will take longer to repair than the technical patches.

The protocols implementing strict collateral caps, mandatory bridge audits, and multi-sig requirements are moving in the right direction, but these are fixes for the last exploit. The structural issue remains unchanged. DeFi's composability is its greatest strength and its greatest systemic risk, and until the industry builds security standards that match the interconnectedness of its collateral chains, every liquid staking derivative is a potential rsETH waiting to break.

Watch Aave's governance votes over the next two weeks. If the 15% collateral cap passes, it becomes the new industry benchmark and the first real structural safeguard against this class of exploit.

This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency trading involves substantial risk. Always conduct your own research before making trading decisions.