In just 48 hours, approximately $13 billion has been withdrawn from the DeFi market following the KelpDAO exploit on April 18—an incident now regarded as the largest decentralized finance hack of 2026. Beyond the direct loss of roughly $290 million, the event triggered a massive wave of liquidity withdrawals that quickly spread to lending protocols like Aave, where a portion of the exploited assets had been used as collateral.
DeFi TVL Drops $13B in 48 Hours
Data from DefiLlama shows that total DeFi Total Value Locked (TVL) fell from approximately $99.4 billion to $86.2 billion, representing a drop of over $13 billion. Specifically, DeFi TVL on Ethereum plummeted from around $56.5 billion on April 18 to nearly $46 billion in just two days, equivalent to a nearly $10 billion decline within this ecosystem alone.
Total DeFi TVL chart. Source: DefiLlama
The TVL decline was primarily driven by liquidity withdrawals and the closing of positions related to restaking and bridges, rather than spot market sell-offs—indicating that capital is exiting higher-risk structures.
The event stemmed from a vulnerability in KelpDAO’s LayerZero-based rsETH bridge path, where a “1-of-1 DVN” validation configuration allowed a fraudulent cross-chain message to be accepted without a corresponding burn transaction. This flaw released 116,500 rsETH from the Ethereum-side adapter, creating a surplus of unbacked assets on the associated chains.
Kelp Exploit Triggers Liquidity Unwind
The direct damage of approximately $290 million from the exploit accounts for only a small fraction of the over $13 billion TVL drop across the market. The majority of the volatility stemmed from the subsequent position unwinding process.
rsETH is widely used as collateral to borrow ETH or stablecoins, which are then further deployed into other strategies. When this asset encountered the exploit, these chains of related positions were forced to close to mitigate risk.
This process led to liquidity withdrawals from lending protocols, reduced leverage, and defensive portfolio restructuring. Consequently, TVL dropped rapidly, even before forced liquidations occurred on a large scale.
Data from Coinglass shows that total liquidations in 24 hours reached approximately $254 million; while volatility increased, it remained significantly lower than in previous panic liquidation events.
This suggests that most of the capital leaving DeFi during this period came from proactive deleveraging rather than forced liquidations.
Aave Absorbs Most of the Market Shock
Aave became the focal point as a significant portion of the exploited assets was funneled into this lending system.
According to a report published by LlamaRisk on April 20, out of the total 116,500 rsETH withdrawn, approximately 89,567 rsETH (~$221.39 million) was deposited into Aave as collateral. From there, the attacker borrowed roughly 82,650 WETH (~$190.86 million) along with a small amount of wstETH, with positions maintaining health factors around 1.01–1.03—very close to the liquidation threshold.
In response to this risk, Aave quickly froze all rsETH and wrsETH reserves and reduced the LTV (Loan-to-Value) ratio to 0 to prevent new positions from being opened. Several related WETH markets were also frozen, while interest rate models were adjusted to alleviate liquidity pressure within the system.
The protocol also confirmed that the system itself was not exploited and that the incident originated entirely from external assets.
Aave TVL chart. Source: DefiLlama
Aave’s TVL dropped sharply following the incident, from approximately $26.3 billion to $20 billion in a short period, before further retreating to around $16.4 billion. Despite not being the site of the exploit, Aave became the absorption point for much of the market pressure due to its direct exposure to rsETH.
Bad Debt Risk Ranges $120M–$230M
The potential bad debt on Aave remains difficult to determine precisely, as it depends on how the unbacked rsETH is handled and the loss allocation mechanism.
According to scenarios modeled in the LlamaRisk report, total bad debt on Aave could range from approximately $123.7 million to $230.1 million, depending on whether losses are distributed evenly or concentrated on rsETH assets on Layer 2s.
The impact level could be significantly higher on chains such as Mantle, Arbitrum, and Base, where liquidity is lower, and position buffers are more limited.
Market at a Short-Term Inflection Point
Following the initial shock, positions related to rsETH have largely been isolated on Aave and have not yet recorded direct impacts at the protocol level.
However, capital continues to flow out of Aave, which holds the majority of the exposure related to the exploited rsETH. If the value of this asset continues to decline or if loss allocation creates further pressure on Layer 2 markets, the impact could spread to collateral values and liquidity across the lending sector.
