DeFi Still in Limbo After $290M Kelp DAO Hack

Today’s big story:

Four days into the fallout from the KelpDAO bridge exploit, DeFi users sit in limbo.

Also:

Aave lenders get escape hatch
Aave highlights bad debt scenarios
Almost half of LayerZero apps have Kelp’s configuration
DeFi tokens drop on contagion
Hecto is building crypto-native access to private equity [MEDIA PARTNERSHIP]
Bitcore to launch first privately-issued ILS stablecoin [MEDIA PARTNERSHIP]

Nexo is a digital wealth platform offering crypto yield up to 15% and crypto-backed credit lines from 1.9%. Join and get 30-day access to exclusive rates. Terms apply.

TICKER	VALUE	24H
BTC	$75,959	▲ 2.45%
ETH	$2,319.6	▲ 2.01%
XRP	$1.43	▲ 1.78%
BNB	$629.12	▲ 1.88%
SOL	$85.67	▲ 2.26%

The Week DeFi's Composability Was Both the Bug and the Fix

Four days into the fallout from the KelpDAO bridge exploit, we are in a moment that still doesn't resolve cleanly into a win or a loss. Or, I should say, we don’t know yet how big a loss it will actually be.

On April 18, an attacker exploited a LayerZero bridge at KelpDAO, so that they could forged a cross-chain message and trick Kelp DAO into minting 116,500 rsETH, roughly 18% of supply, with nothing locked on the source side. If the story had ended there, it would be a bridge exploit. But it didn't. The unbacked rsETH went straight into Aave as collateral and came out as approximately $236 million in borrowed WETH. Those tokens are now gone.

The finger-pointing

Kelp and LayerZero have spent more public energy on who owned the configuration than on who will make users whole. Kelp argues the 1-of-1 DVN was LayerZero's documented default, re-confirmed during its L2 expansion. LayerZero says it’s Kelp’s fault for choosing to operate a single signer.

Aave published an incident report where it modeled its potential bad debt ($124M to $230M) and effectively says the ball is in Kelp DAO’s court as it needs to first decide how to distribute losses of the rsETH, before Aave can move forward with its own compensation plan. We have yet to hear from Kelp or LayerZero on their compensation plans.

Meanwhile, users are frozen

Aave's WETH pool hit 100% utilization within hours of the hack and has stayed there. ETH depositors cannot withdraw. Stablecoin markets followed as capital tried to rotate out of ETH into USDC and USDT.

Aave's Umbrella safety module, meant to absorb exactly this kind of loss, is in a 20-day cooldown. Roughly 80% of stakers had entered cooldown before the exploit was confirmed. Whether bad debt is socialized across depositors, stakers, or the DAO treasury has not been voted.

This is the limbo Aave users are is living in.

Composability as a cure

And yet the same architectural openness that transmitted the exploit has produced its own antidote.

Fluid, with Lido, Ether.fi, 1inch, 0x, and Kyber, shipped the aWETH Redemption Protocol in under 24 hours. It has already routed 58,510 aWETH, or roughly $136 million, out of Aave's frozen pool into wstETH and weETH, at a ~2% discount versus ~23% on secondary markets.

The fix didn’t need a governance vote, or permission from Aave or Kelp. The rescue assembled itself over a weekend on primitives that were already live. One silver lining of this hack is that the first DeFi crisis of this scale was met with an organically assembled exit route.

The bigger stakes

DeFi was, until a week ago, having its best conversation in two years. Institutional RWA desks were ramping. Asset managers were exploring onchain credit. The narrative was that this cycle, finally, was the one where DeFi joined the financial stack.

That narrative doesn't survive unchallenged if the lead story is that a default bridge SDK setting drained $290M, saddled the largest lending protocol with $200M in bad debt, and left retail unable to withdraw for weeks while three teams argued about fault.

What it could survive is a resolution that shows DeFi can metabolize a systemic shock without a central actor rescuing it. It should be a mix of Aave’s and Kelp’s compensation plans, a LayerZero commitment on configuration standards, and Fluid’s escape hatch.

We don't know what exactly the solution will look like. The outcome will dictate whether this week becomes the cautionary case study institutional risk teams cite to stay out or the proof point they cite to come in.

With love,

Cami, Founder of The Defiant

Quantum Could Break Bitcoin Sooner Than We Thought | Alex Pruden

In this episode of The Defiant Podcast, Camila Russo sits down with Alex Pruden, co-founder and CEO of Project 11, to unpack what the latest quantum breakthroughs actually mean for Bitcoin, Ethereum, and the broader crypto ecosystem.

Alex explains why the latest research matter, how quantum computers could use Shor’s algorithm to break the cryptography behind blockchain ownership, why exposed public keys are especially vulnerable, and what “Q-Day” could look like if the industry is unprepared.

DeFi Protocols Launch Joint Escape Hatch for Aave ETH Lenders and Loopers

After the Kelp exploit pushed Aave’s WETH utilization to 100%, Fluid teamed up with Lido, Ether.fi, 1inch, 0x, and Kyber to launch an aWETH Redemption Protocol that lets trapped Aave ETH lenders and loopers exit or switch collateral. The system processed about $136M from Aave’s frozen WETH pool in its first 48 hours, offering exits at roughly a 2.2% haircut versus far steeper discounts in secondary markets.

Why it matters: This is a strong example of DeFi’s “immune system” kicking in. The same composability that let the exploit cascade across protocols also let builders assemble a live workaround in under a day, without waiting for governance or a bailout. It does not erase Aave’s bad debt, but it shows open finance can route around damage faster than many expected.

Aave Models $124M to $230M in Bad Debt From Kelp Exploit

Aave’s incident report put concrete numbers on the damage from the April 18 Kelp rsETH bridge exploit. Service providers modeled two outcomes: about $123.7M in bad debt if losses are socialized across all rsETH holders, or about $230.1M if losses are isolated to L2 rsETH. The report also recommended pausing Aave’s Umbrella safety module, while noting the DAO treasury held about $181M as of April 20.

Why it matters: Markets now have a framework for pricing what Aave may actually absorb, and it highlights how bridge risk can migrate into lending markets and then into DAO backstops. It also underscores that “safety modules” may not neatly cover the kind of cross-chain failure DeFi is now facing.

Dune Analytics Reveals 47% of LayerZero OApps Use Minimal DVN Security Following KelpDAO Hack

A Dune analysis of roughly 2,665 active LayerZero OApp contracts found that 47% use a 1-of-1 DVN setup, the most minimal validator configuration. Another 45% use 2-of-2, while only about 5% use 3-of-3 or stronger. KelpDAO’s exploited rsETH setup fell into the 1-of-1 bucket.

Why it matters: The Kelp exploit may not be an isolated app failure so much as a warning about default security standards across omnichain infrastructure. If nearly half of LayerZero apps rely on minimal validation, the market is likely to start distinguishing more aggressively between protocols that are merely “cross-chain” and those that are meaningfully hardened.

DeFi Contagion Spreads Beyond Aave as LayerZero, Lido, Ethena Suffer Sharp Declines

Santiment data showed the market selling off not just AAVE and LayerZero’s ZRO, both down 22%, but also LDO, ENA, and COMP, even where direct exposure was limited or nonexistent. ETH stayed flat during the same window, suggesting the selloff was aimed specifically at DeFi risk rather than the broader market.

Why it matters: This shows the market treating the Kelp/Aave incident as sector contagion, not a single-protocol accident. Investors repriced bridge operators, lending protocols, and even adjacent DeFi names together, reflecting a broader loss of confidence in interconnected DeFi plumbing. In other words, composability is being valued both as a growth engine and as a shared source of systemic risk.