DeFi Market Loses $13 Billion After KelpDAO Exploit, Aave Faces $230 Million Bad Debt Risk
On April 18, 2026, a flaw in the LayerZero-based rsETH bridge of KelpDAO enabled a deceptive cross-chain message to release 116,500 rsETH, leading to an estimated loss of around $290 million, which is recognized as the most significant DeFi hack of 2026. Following this event, liquidity withdrawals ensued, causing the total value locked (TVL) to plummet from $99.4 billion to $86.2 billion within just 48 hours. The DeFi TVL on Ethereum dropped from $56.5 billion to nearly $46 billion. Aave responded to the market disruption by accepting 89,567 rsETH (approximately $221.39 million) as collateral, while the attacker borrowed 82,650 WETH (around $190.86 million). Aave subsequently froze its rsETH reserves and modified LTV ratios, resulting in a TVL decline from $26.3 billion to $16.4 billion, with potential bad debt on Aave estimated at $230.1 million.
Key facts
- KelpDAO exploit occurred on April 18, 2026, causing direct losses of roughly $290 million
- DeFi TVL dropped by over $13 billion in 48 hours, from approximately $99.4 billion to $86.2 billion
- Ethereum DeFi TVL fell from around $56.5 billion to nearly $46 billion in two days
- 116,500 rsETH was released due to a vulnerability in KelpDAO's LayerZero-based rsETH bridge path
- Approximately 89,567 rsETH (~$221.39 million) from the exploit was deposited into Aave as collateral
- Aave's TVL dropped from approximately $26.3 billion to around $16.4 billion after the incident
- Potential bad debt on Aave could range from $123.7 million to $230.1 million according to LlamaRisk report
- Total liquidations in 24 hours reached approximately $254 million
Entities
Institutions
- KelpDAO
- Aave
- DefiLlama
- Coinglass
- LlamaRisk
- LayerZero
- NFT Plazas
Locations
- Ethereum
- Mantle
- Arbitrum
- Base