The decentralized finance (DeFi) ecosystem is experiencing a strong capital outflow following the weekend exploit of the KelpDAO protocol.
Leading DeFi lending platform Aave has lost $8.45 billion in deposits in the last 48 hours, leading to a broader $13.21 billion decline in total value locked (TVL) across DeFi. TVL refers to the combined dollar value of cryptoassets deposited in DeFi protocols, such as Aave, and is widely used to measure liquidity and overall market activity.
The total value locked in DeFi fell from $99.497 billion to $86.286 billion, while Aave’s TVL decreased $8.45 billion to $17.947 billion during the same period, according to DefiLlama. Protocol-level data shows double-digit percentage drops across all platforms, including Euler, Sentora, and Aave, with losses concentrated in lending, buyback, and yield strategies tied to the affected collateral.
The move stems from a $292 million Kelp bridge exploit that allowed attackers to use stolen rsETH, a liquid re-staking token widely used in DeFi, as collateral to borrow funds on lending platforms.
Because these stolen tokens lacked legitimate backing, borrowing against them created potential shortfalls for lenders. It is similar to scamming a traditional bank by depositing fake fiat money and taking out loans against it, ultimately leaving the lender with bad debt.
The protocols responded by freezing affected markets, while panicked users withdrew funds, causing a wide drop in total value locked.
Token prices have moved less sharply than deposits. The AAVE token is down about 2.5% in 24 hours, while UNI and LINK are down less than 1% over the same period, according to market data from CoinDesk.
Peter Chung, head of research at Presto Research, said in a note that the incident highlights risks in cross-chain infrastructure, particularly in the verification systems used by bridges.
Early analyzes suggest that the problem may have originated in the verification layer and not in the smart contracts themselves.
Chung added that the episode also shows how interconnected DeFi protocols can transmit shocks beyond the initial point of failure, with withdrawal activity and market freezes spreading to platforms without direct exposure to the exploit.
