What's Driving Token Prices? April 22, 2026

KERNEL/AAVE/ZRO (-20%/-12%/-17%)
- Saturday afternoon, hackers (believed to be North Korean agents) minted $292M of rsETH, a liquid-staking version of ETH. Hackers were able to mint this rsETH by exploiting the bridge between the Ethereum mainnet and Unichain, which was secured by LayerZero’s bridging technology. Specifically, hackers were able to manipulate what is called the “Decentralized Verifier Network” (DVN), which is a network of nodes that verify if bridge transactions are true. However, in the case of KelpDAO’s setup, they only had a 1-of-1 verifier (single-DVN) network setup. The hackers were then able to mint rsETH tokens that were unbacked, and then took out loans on Aave. Since rsETH is considered legitimate collateral on lend/borrow protocols, Aave worked as intended, swapping rsETH for ETH. The hackers were then able to use the legitimate ETH to trade it elsewhere.
- The hack happened very quickly and first resulted in KelpDAO pausing its protocol; Aave also paused the impacted markets, but not before word spread of the hack, causing a “bank run” as users rushed to withdraw deposited ETH. As loans on Aave are pooled, users who just deposited ETH were exposed to other ETH-related pools that became depleted and are essentially “locked” and unable to withdraw or unwind loan positions until the pools become better capitalized.
- On Sunday, LayerZero released its incident report after reviewing the exploit and laid the blame on KelpDAO for electing to use a single-DVN setup, despite LayerZero’s recommendation of a more secure multi-DVN setup. Important to note that LayerZero operates the DVN setup on KelpDAO’s behalf. KelpDAO has refuted LayerZero’s claims, and as of now, it seems this will play out in a legal battle between the two entities. Meanwhile, Aave is facing roughly $196M in bad debt after loaning out ETH against collateral that is worth $0. Aave’s system has an insurance fund (called Umbrella coverage), but it will not cover the full amount of the losses. The question now is who covers these losses? KelpDAO, LayerZero, or Aave? And are the losses split across all users of Aave across all chains or just across the impacted chains? Aave’s risk manager published a governance proposal on Monday outlining scenarios under which bad debt could be settled within its system, but until more decisions are made on how this hack will be handled, nothing has been decided yet. Late Monday evening, Aave unfroze its Ethereum mainnet market for ETH; however, with utilization at 100%, there is no liquidity to withdraw. Much of the damage was swift in this case: outside the stolen funds, Aave has seen $15B in TVL (-34%) leave the protocol, and $22B in TVL has left DeFi overall since Saturday.
ARB (+15%) - The Arbitrum Security Council, which presides over Layer-2 protocol Arbitrum, decided late Monday to freeze the assets held by the attackers' wallets (about 30K ETH) and transfer them to an intermediary wallet. The council plans to transfer these assets to the appropriate parties after a resolution over the hack has been reached. This move raises many concerns around decentralization, but in this case, Arbitrum consulted law enforcement and weighed its commitment to its users before taking this action.
LDO/EUL/COMP/FLUID/SPK/MORPHO (+5.6%/+22%/+1%/+24%/+69%/+6.6%) - Other impacted DeFi protocols included liquid staking protocol Lido DAO and lending protocols Euler, Compound, Fluid, Spark, and Morpho. Lido DAO operates an EarnETH vault, which was significantly exposed to rsETH/ETH lending strategies on Aave and therefore paused new deposits to its vault. Euler, Compound, Fluid, Spark, and Morpho paused their markets associated with rsETH and with many of the protocols seeing outflows of up to -30%.

DISCLAIMER: This commentary is not intended to be investment advice, investment research, or a recommendation. Please consult your investment professional for your own circumstances.

Disclaimer: This commentary is provided as general information only and is in no way intended as investment advice, investment research, legal advice, tax advice, a research report, or a recommendation. Any decision to invest or take any other action with respect to any investments discussed in this commentary may involve risks not discussed, and therefore, such decisions should not be based solely on the information contained in this document. Please consult your own financial/legal/tax professional.

Statements in this communication may include forward-looking information and/or may be based on various assumptions. The forward-looking statements and other views or opinions expressed are those of the author, and are made as of the date of this publication. Actual future results or occurrences may differ significantly from those anticipated and there is no guarantee that any particular outcome will come to pass. The statements made herein are subject to change at any time. Arca disclaims any obligation to update or revise any statements or views expressed herein. Past performance is not a guarantee of future results and there can be no assurance that any future results will be realized. Some or all of the information provided herein may be or be based on statements of opinion. In addition, certain information provided herein may be based on third-party sources, which is believed to be accurate, but has not been independently verified. Arca and/or certain of its affiliates and/or clients may now, or in the future, hold a financial interest in investments that are the same as or substantially similar to the investments discussed in this commentary. No claims are made as to the profitability of such financial interests, now, in the past or in the future and Arca and/or its clients may sell such financial interests at any time. The information provided herein is not intended to be, nor should it be construed as an offer to sell or a solicitation of any offer to buy any securities, or a solicitation to provide investment advisory services.