The decentralized finance (DeFi) sector is bleeding after a string of platform exploits pushed sector-wide losses well past half a billion dollars in recent weeks, with the fallout from Kelp DAO’s bridge incident on Saturday accelerating the decline.
Total value locked across DeFi has fallen to roughly $82.4 billion, its lowest level in a year and a 25% drop from the $110 billion level seen at the start of 2026.
In the day following the $292 million Kelp DAO exploit, DeFi posted a single-day drawdown of about 5.6%, placing the move just shy of the 98th percentile of severity since 2024, according to data reviewed by The Block analysts.
Losses were most pronounced in lending markets, where TVL dropped roughly 13%, while liquid staking fell about 3.4%. Decentralized exchanges and derivatives protocols also saw declines in the 2%Â to 3% range.
The Kelp DAO exploit adds to a tally of similar breaches, including the roughly $285 million Drift Protocol exploit earlier this month. Other smaller incidents involving Resolv Labs, Hyperbridge and Rhea Finance, among others, have brought the total over $600 million in losses in three weeks.
In total, crypto security firm Halborn estimates $86 million was lost to DeFi attacks in January, $23.5 million in February, and over $27 million in March. The Drift attack represents the largest Solana-based exploit to date.
Kelp DAO updates
The Kelp DAO exploit, which involved an attacker manipulating a cross-chain message to drain rsETH from its LayerZero-powered bridge, spilled into lending markets after the stolen assets were used as collateral on Aave.
The attack is believed to be linked to the North Korean hacking group Lazarus, according to preliminary findings.
Aave responded by freezing rsETH on its platform to limit exposure, leaving some of its stablecoin markets short on available liquidity and effectively locked up billions in deposits.
Blockchain analytics firm Arkham Intelligence said Kelp DAO only has limited options if no external capital is raised.
One approach would involve socializing losses across all rsETH holders, where everyone takes a loss of roughly 16%.
Another would prioritize full backing for Ethereum mainnet holders, leaving Layer 2 users to absorb the bulk of the losses. Under that plan, Arkham estimates Aave users holding rsETH could face losses of up to roughly $267 million.
In a Monday post on X, LayerZero, which powered the exploited bridge, said the incident stemmed from Kelp DAO’s configuration using a single verification setup, calling it a “single point of failure” and reiterating that other integrations were not impacted.
The incident has caused tension between Kelp DAO, Aave and LayerZero, who are reportedly trying to pin the blame on each other.
“We should get LayerZero, Kelp, Aave into a room to figure things out,” Yearn Finance core developer Banteg wrote on X. “So far things are not looking good, everyone has lawyered up and going full PvP on each other.”
Disclaimer: The Block is an independent media outlet that delivers news, research, and data. As of November 2023, Foresight Ventures is a majority investor of The Block. Foresight Ventures invests in other companies in the crypto space. Crypto exchange Bitget is an anchor LP for Foresight Ventures. The Block continues to operate independently to deliver objective, impactful, and timely information about the crypto industry. Here are our current financial disclosures.
© 2026 The Block. All Rights Reserved. This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.
