‘DeFi is dead’: crypto community scrambles after this year’s biggest hack exposes contagion risks
Developers and traders warn of structural risks as a cross-chain exploit spreads fear and prompts billions to flee DeFi platforms.
What to know:
- A $292 million exploit of Kelp DAO’s rsETH token triggered a broad liquidity crunch across DeFi, sparking heavy withdrawals from major lending platforms, including Aave.
- Developers claim the hack stemmed from a misconfigured cross-chain verification setup in LayerZero-based infrastructure, exposing how flexible “modular” security, without strong minimum standards, can create systemic risk.
- The incident, which affected about 18% of the rsETH supply and follows a string of large DeFi hacks this month, has intensified doubts about the sector’s resilience and prompted protocols to freeze markets and urgently review their cross-chain configurations.
“The rsETH hack is leading to withdrawals across all lending protocols, even on solana and unaffected protocols,” 0xngmi said in one post on Sunday, pointing to steep outflows including “Aave: -6,200m (-23%) net inflows” and smaller but notable declines across Morpho, Sky and JupLend. rsETH is liquid restaking protocol Kelp DAO’s restaked ether and is a Liquid Restaking Token (LRT) that allows users to earn ether staking and restaking rewards while keeping their assets liquid, even when they are locked in staking.
That pressure quickly turned into something more severe. One widely circulated post by Josu San Martin described cascading liquidity stress inside lending markets: “ETH depositors cannot withdraw the ETH so they are borrowing stables to ‘withdraw’ funds… This is a full on run on AAVE.”
While Stani Kulechov, Aave’s founder, said the exploit was external and that the protocol’s contracts were not compromised, the depositors panicked. The total value locked (or deposits) dropped from $26.4 billion on April 18 to nearly $20 billion in U.S. morning hours on Sunday, per DefiLlama. The AAVE token also fell more than 18% as depositors scrambled to withdraw their money through the weekend.
A ‘case study’
The exploit itself has become a focal point for engineers and developers.
