Morning Minute: DeFi's Future in Question After $292M KelpDAO Exploit

3,478.5543
Morning Minute is simply a regular newsletter written by Tyler Warner. The investigation and opinions expressed are his ain and bash not needfully bespeak those of Decrypt. And check retired our new regular quality show covering each of the apical stories successful 5 minutes oregon less, downloadable connected Apple Pod oregon Spotify.

GM!

Today’s apical news:

• Crypto majors autumn past rebound arsenic Iran tensions escalate; BTC astatine $75.4k

• ETFs spot $1.4B successful inflows connected the week, 2nd biggest week of year

• DeFi TVL falls by $13B arsenic KelpDAO exploit fallout worsens; AAVE -25%

• Vercel CEO says “highly sophisticated” actors utilized AI for its exploit

• Asteroid meme holds astatine $150M marketplace headdress aft Elon says “ok” for SpaceX mascot

Saturday astatine 17:35 UTC, an attacker sent a azygous crafted connection to Kelp DAO’s LayerZero-powered cross-chain bridge.

The span accepted it arsenic morganatic and released 116,500 rsETH - astir $292 cardinal and 18% of full circulating supply—to a wallet that had been pre-funded done Tornado Cash 10 hours earlier. No ETH ever changed hands connected the different side. The rsETH was efficaciously minted from nothing. The attacker deposited it into Aave V3 and V4 arsenic collateral, borrowed existent wrapped ETH against it, and walked.

Aave didn’t get hacked. Its contracts are fine. But it’s present carrying astir $196M successful atrocious indebtedness it didn’t create, due to the fact that rsETH had been whitelisted arsenic ETH-correlated collateral—a faulty assumption.

In the aftermath, TVL connected AAVE dropped 25% from $26.4B to ~$20B successful a azygous time and continues to autumn by the day. Broader DeFi TVL fell by $13B. The AAVE token fell 30%.

ETH depositors trying to retreat recovered liquidity astatine zero, truthful they started borrowing stablecoins against their deposits to exit—a textbook slope run. SparkLend, Fluid, Upshift, and Lido each froze oregon paused rsETH exposure. rsETH holders connected 20+ chains present person tokens of uncertain backing.

Aave’s ain connection Sunday said rsETH connected Ethereum mainnet is “fully backed” but remains frozen “out of an abundance of caution.” But the harm has been done.

DeFi users are re-evaluating the calculus. Does it marque consciousness to hazard exploits for mean yield? And present each lending protocol has to reassess security. It volition instrumentality clip to rebuild from this, if it’s adjacent possible.

There person been $600M mislaid from DeFi via exploits successful conscionable the past 3 weeks. And the gait is accelerating…

Key Details:

• Kelp DAO’s LayerZero bridge was exploited Saturday for 116,500 rsETH (~$292M, 18% of supply); attacker minted unbacked rsETH and utilized it arsenic Aave collateral to get existent WETH; ~$196M successful atrocious indebtedness near connected Aave; AAVE -30%; largest DeFi exploit of 2026

• The contagion: Aave froze rsETH and WETH crossed Ethereum, Arbitrum, Base, Mantle, and Linea; TVL dropped $6.2B successful 1 day; ETH depositors borrowing stablecoins to exit triggered a slope tally dynamic; SparkLend, Fluid, Upshift, and Lido each froze rsETH exposure

• The structural issue: LRT tokens similar rsETH were whitelisted arsenic near-ETH collateral connected Aave, Compound, and Euler; this exploit assumes backing was intact astatine each times; it wasn’t; each DeFi lending protocol present needs to reassess liquid restaking token collateral risk