A critical exploit has cast doubt over DeFi’s future, as $292 million vanished from KelpDAO. At 17:35 UTC on Saturday, a sophisticated attacker manipulated Kelp DAO’s LayerZero-powered cross-chain bridge by sending a fake message that was wrongly validated. This led to the transfer of 116,500 rsETH, equivalent to roughly $292 million or 18% of the total circulating supply, into a wallet pre-funded through Tornado Cash ten hours earlier. No ETH was exchanged on the opposite side; instead, the rsETH was generated out of thin air. The attacker then utilized Aave V3 and V4 platforms to deposit this as collateral, borrowed real wrapped ETH against it, and exited with gains.
The incident left AAVE unharmed in terms of contract integrity but saddled with approximately $196 million in bad debt due to the mistaken whitelisting of rsETH as ETH-correlated collateral. Subsequently, TVL on AAVE plummeted by 25%, decreasing from $26.4 billion to around $20 billion within a day, and continues its downward trajectory. The broader DeFi TVL saw a decline of $13 billion, while the AAVE token’s value dropped by 30%.
In response, ETH depositors found themselves unable to withdraw due to zero liquidity, prompting them to borrow stablecoins against their deposits—a classic bank run scenario. Platforms such as SparkLend, Fluid, Upshift, and Lido either froze or paused their exposure to rsETH. Holders of rsETH on over 20 chains now face tokens with uncertain backing.
Aave announced on Sunday that the rsETH on Ethereum mainnet is “fully backed” but remains frozen out of caution. Nevertheless, significant damage has occurred. DeFi users are reconsidering their willingness to risk potential exploits for average yields, and lending protocols must reassess their security measures—a process expected to be lengthy, if feasible.
In just the past three weeks, $600 million have been lost from DeFi due to various exploits, with an accelerating pace. Friday marked the most turbulent 24-hour period in crypto markets since geopolitical tensions escalated.
Iranian FM Araghchi had claimed the Strait of Hormuz was “fully open” to commercial vessels, a statement echoed by Trump on Truth Social suggesting Iran’s agreement for an “unlimited” suspension of its nuclear program. This led Bitcoin to surge from $74.5K to $78,400—its highest since February 4—and oil prices fell nearly 10% to about $82 per barrel. The S&P 500 closed at a record 7,121, with crypto short liquidations exceeding $600 million and ETF inflows reaching approximately $800 million—the largest in months.
However, by Saturday morning, Iranian radio transmissions indicated the strait was under “strict management,” causing BTC to retract to around $74K. Oil prices recovered to $90, while stock futures turned red as a return to conflict seemed more probable than ever.
On Thursday, Strategy filed a preliminary proxy proposing that STRC dividend payments shift from monthly to semi-monthly distributions at an unchanged annual rate of 11.5%, maintaining the $1.2 billion obligation. This change aims to stabilize price and enhance liquidity by eliminating the two-week period where STRC trades below par value.
Meanwhile, Liv Perrotto’s dream of making her designed plush Shiba Inu mascot for SpaceX came true posthumously. After her story went viral with Elon Musk’s acknowledgment, ASTEROID meme coin soared to a market cap nearing $155 million following his confirmation that Asteroid would be the official SpaceX mascot.
The question now is whether this gesture marks continued support from Elon or was merely a one-time response.