Crypto Hackers Trigger $13B Loss in a Single Weekend: What Really Happened?

Quick Takeways 

• The DeFi sector recorded a 5.6% single-day drawdown – a major one since 2024. 
• Kelp Dao, Aave, and LayerZero have been blaming each other. It is unclear how the losses will be distributed. 

The decentralized finance (DeFi) sector has been slumping after major platforms have been exploited in a matter of days. The sector has recorded a loss of half a billion dollars in recent weeks after the fallout from Kelp DAO’s cross-chain bridge was hit by a major exploit. 

​Total value locked across DeFo has fallen to roughly $82.4 billion, recording the lowest level in a year and a 25% drop from the $110 billion level seen at the beginning of 2026. 

The Major Trigger:The $292 Million KelpDAO Exploit 

After the day following the $292 million Kelp DAO exploit, DeFi posted a single-day drawdown of about 5.6%, recording a 98% of severity since 2024. 

​Losses were mostly recorded in lending markets, and TVL has dropped roughly by 13%, and liquid staking fell by about 3.4%. Decentralized exchanges and derivatives protocols also saw a plunge around the 2% to 3% range. 

This exploit adds Kelp DAO to the list of similar breaches, including the roughly $285 million Drift Protocol exploit earlier this month. Other minor incidents involve Resolv Labs, Hyperbridge, and Rhea Finance, bringing the total losses to over $600 million in just three weeks. 

​In total, crypto security firm Halborn estimates $86 million in losses to DeFi attacks in January, $23.5 million in February, and over $27 million in March. The Drift attack marks the largest Solana-based exploit to date. 

​Kelp DAO Updates 

The Kelp DAO exploit was carried out by an attacker manipulating a cross-chain message to drain rsETH from its LayerZero-powered bridge, which spilled into lending markets after stolen assets were used as collateral on Aave. 

​The attack is believed to be linked to a North Korean hacking group called Lazarus. Aave responded by freezing rsETH on its platform, limiting exposure, leaving some of its stablecoin markets short on available liquidity, and effectively locking up billions in deposits. 

​Blockchain analytics firm Arkham Intelligence said that Kelp DAO only has limited options if no external capital is raised. One way would involve socializing losses across all rsETH holders, where everyone else takes a loss of approximately 16%. 

​Another approach is to prioritize full backing for Ethereum mainnet holders, leaving Layer 2 users to absorb the bulk of the losses. Within this plan, Arkham estimates Aave users holding rsETH could face losses of up to roughly $267 million. 

​LayerZero’s post on X said that the exploit stemmed from Kelp DAO’s configuration, which uses a single verification setup, calling it a “single point of failure,” and reinforced that other integrations are unaffected. 

​This incident has caused tensions among the three firms Kelp DAO, Aave, and LayerZero, who have been pinning the blame on each other. It has also sparked serious debate about the security of cross-chain bridges and the systemic risks of using restaked assets as collateral. 

Broader Market Impact on DeFi Tokens

The fallout from the exploit wasn’t limited to liquidity metrics alone. Major DeFi governance tokens saw sharp volatility as traders priced in increased systemic risk. Tokens tied to lending protocols and restaking ecosystems experienced the steepest intraday swings, with some briefly shedding double-digit percentages before partial recovery. Market makers reportedly widened spreads across DeFi pairs, reflecting uncertainty about collateral quality and counterparty exposure across interconnected protocols.

Restaking: Innovation or Systemic Risk Amplifier?

The rise of restaking mechanisms like rsETH has significantly increased capital efficiency in DeFi, allowing assets to secure multiple protocols simultaneously. However, this same structure also amplifies systemic risk.

When restaked assets are compromised, the impact is not isolated. Instead, it propagates across lending markets, derivatives platforms, and liquidity pools that accept these assets as collateral.

In this case, what began as a bridge exploit escalated into a multi-layer liquidity disruption.

Market Reaction and Liquidity Stress

Following the exploit, DeFi markets experienced a sharp repricing of risk. Total Value Locked dropped significantly, with lending markets seeing the steepest withdrawals. Liquid staking protocols also recorded meaningful outflows, while decentralized exchanges and derivatives platforms experienced moderate declines.

Market makers widened spreads and reduced exposure to affected assets, signaling increased uncertainty in collateral reliability and cross-chain integrity.

The Debate Over Loss Distribution

According to blockchain risk assessments, Kelp DAO may face limited options for resolving the deficit without external intervention.

Two primary recovery paths have been discussed:

1. Loss Socialization: Spreading losses across rsETH holders, potentially resulting in estimated double-digit percentage reductions in user balances.
2. Tiered Compensation Model: Prioritizing protection for Ethereum mainnet holders while allocating larger losses to Layer 2 participants and protocol-level integrations.

Both approaches carry significant trade-offs between fairness, trust, and systemic stability.

Alleged Links to State-Sponsored Actors

Some blockchain intelligence firms have suggested possible involvement of North Korea-linked hacking groups, including Lazarus. While attribution in crypto exploits remains complex and probabilistic, such groups have historically been associated with cross-chain bridge attacks and laundering operations involving decentralized infrastructure.

These actors are known for rapidly moving funds across chains to obscure traceability, often exploiting composability features in DeFi ecosystems.

Systemic Risk: The Bigger Question for DeFi

Beyond the immediate financial losses, this incident raises deeper structural concerns about DeFi’s architecture:

• Cross-chain bridges remain high-risk infrastructure points
• Restaking increases composability but reduces isolation between protocols
• Emergency interventions introduce semi-centralized control during crises
• Liquidity dependence creates rapid contagion during stress events

Together, these factors highlight a core tension in DeFi: efficiency versus resilience.

Conclusion

The Kelp DAO exploit and its cascading effects represent more than a single security failure-they expose how tightly interwoven DeFi systems have become. While losses are still being fully assessed, the broader impact lies in shaken confidence across cross-chain infrastructure and restaking models.

As protocols continue to evolve, the industry faces a critical question: can DeFi scale composability without repeatedly inheriting systemic fragility?

Also Read: Best Memecoins to Watch Following ASTEROID’s Massive 68,000% Surge