The Kelp DAO Hack and What It Means for DeFi Going Forward
The stock market rally continued last week, albeit ending the streak of three consecutive 3%+ weekly gains. Nevertheless, this move continues to impress. While I littered last week’s write-up with charts showing the breadth and strength of this rally, here’s one more just for good measure. U.S. retail sales hit another all-time high, while consumer sentiment is at its lowest level in history. That sounds impossible, but it’s indicative of the times. Continued inflation is good for revenues, at least nominally, as revenues tick up from higher prices, but it is terrible for consumer confidence and sentiment.
Most digital asset prices have trended higher in lockstep with equities over the past four weeks. That’s pretty boring, but it’s true. We’ve been waiting all year for an idiosyncratic event or theme to pull crypto asset prices away from macro (other than Saylor buying Bitcoin), and we finally got one last week. Unfortunately, it wasn’t what crypto bulls wanted to see.
On April 18th, the Kelp DAO exploit marked the largest DeFi hack of 2026, with roughly $292 million in rsETH drained via a compromised cross-chain bridge configuration. The attacker (North Korea, who else?) used the stolen tokens as collateral on Aave to borrow about $190 million in wETH, effectively extracting real liquidity against fake collateral. What made this event particularly damaging wasn’t just the size, but the design loop it exposed. A single upstream configuration decision (Kelp’s use of a single verifier) propagated through multiple layers of DeFi infrastructure and ultimately left Aave holding the loss. Within days, Aave’s total value locked (TVL) dropped by over $10 billion (roughly 38%), while key lending pools hit 100% utilization, freezing withdrawals and trapping both depositors and borrowers.
The broader impact has been a sharp loss of confidence across DeFi markets. Even participants with no direct exposure to rsETH saw borrowing costs spike 4x and liquidity vanish as a platform-wide bank run unfolded. The episode underscores a core structural issue. DeFi’s composability, often cited as a strength, also acts as a contagion channel where risks are opaque, interconnected, and impossible to fully underwrite. This wasn’t a smart contract failure at Aave, but rather a systemic failure of layered dependencies, governance decisions, and incentive misalignment. DeFi’s efficiency comes with hidden tail risks that only surface under stress, and events like this meaningfully challenge its credibility as institutional-grade financial infrastructure.
This is not good for DeFi or the protocols that house most of DeFi’s activity (i.e., Ethereum). As we’ve discussed at length, DeFi is one of only 3 sectors within blockchain that is growing rapidly (the others being the growth of RWA tokenization and the growth of stablecoins). Further, DeFi is set to get an even bigger boost as tokenized RWAs and stablecoins grow, since DEXs and lend/borrow platforms are the biggest beneficiaries of having more assets on-chain. So this past week’s news is quite a blow.
The narrative that Ethereum and DeFi are dead has been circulating for months, but this latest event has given even the biggest believers reason to pause. Many argue that the yields on DeFi platforms aren’t large enough to compensate for the risk, both the risks that are in plain sight (like counterparty and smart contract risk) and the risks that are hidden (like the interconnectivity exposed in this Kelp DAO and Aave exploit).
While I largely agree with the argument that you’re not being properly compensated for the risks, I don’t think DeFi is dead, because DeFi itself isn’t the problem. The DeFi protocols work great and have solved real problems (eliminating middlemen to allow for cheaper and faster brokerage and banking for the masses).
The reason we keep having DeFi problems is because most of the assets in crypto suck. DeFi always fails when the assets used as collateral fail, like:
There are only a handful of good tokens today that may be used as collateral. This includes:
When we expand the list of good tokens, then DeFi could expand as well. As tokenized RWAs proliferate further and better token issuers emerge, then DeFi may prove its worth. In order for DeFi to thrive, we need to see:
As always, the problem isn’t the rails; it’s the shoddy trains built on the rails. Just like blockchain and crypto weren’t the problem when FTX, BlockFi, Celsius, and Genesis did dumb things… Just like email and dollars weren’t the problem when Nigerian princes scammed you… Just like the internet wasn’t the problem when dark web services popped up.
Yes, regulation will help, but most of this can be solved by the four horsemen of incompetence growing a backbone (exchanges, VCs, market makers, and token issuers). As soon as these gatekeepers start supporting better assets and stop giving dumb assets airtime and liquidity, many of these problems could be reduced. This most recent Kelp DAO exploit would still have happened, but it would not have blown a hole in Aave’s balance sheet (and thus potentially creating haircuts for Aave users) if rsETH had not been allowed to be used as collateral.
Now, back to markets. You’d assume that DeFi assets and ETH got killed last week… only they didn’t. Right now, the crypto market simply cares about global macro more than it cares about idiosyncratic crypto headlines. Not only did most digital assets rise last week, but even AAVE rose by +7%, as its bad debt from this incident is slowly going away via donations from other DeFi protocols. That’s incredible. Aave accumulated bad debt in excess of its “equity” and cash cushion, while simultaneously losing the trust of DeFi users, and the token rose in price.
The lend/borrow sector was hit particularly hard, with deposits down 23.4% and new loans down 19%. Aave was the hardest hit, with a 38% drop in deposits and a 30.5% drop in loans. Maple (-13.1%) and Morpho (-13.7%) also saw the largest outflow in loans, while Spark (+76%) seemed to have absorbed the excess capital.
Borrowing rates also blew out, as we saw massive spikes in ETH, USDC, and USDT borrowing costs. We’d expect this to stabilize as users unwind looping positions and the market absorbs the shock.
Beyond that, this event didn’t really change user behavior. Global crypto DAUs were actually up +6.9% last week, led by NFT Apps (+85%), and CeFi (+67%). Interestingly, DeFi itself saw a +9.3% weekly increase in daily active users despite the Kelp DAO hack, which has touched most projects in the sector.
So if you thought you were confused by crypto before, this past week likely won’t help you clear things up.
