White House Accuses China of 'Industrial-Scale' Theft From American AI Models
White House warns of China's industrial-scale theft of U.S. AI models.
Decrypt1 min read
DeFi Just Lost $15 Billion in Three Days. Something Deeper Than a Hack Is Behind It
TL;DR
DeFi has lost $15 billion in just three days due to a liquidity shock triggered by an exploit at Kelp DAO. An attacker minted tokens without depositing ETH, leading to significant bad debt in lending protocols like Aave.
Key points
- DeFi lost $15 billion in three days
- Liquidity shock triggered by Kelp DAO exploit
- Attacker minted rsETH without depositing ETH
- Bad debt of up to $230 million in Aave
- Incident raises questions about DeFi security
Mentioned in this story
Kelp DAOAave
DeFi is having one of its most difficult weeks in recent memory. What started as a single exploit on April 19 has since cascaded into a system-wide liquidity shock that has rattled confidence across the ecosystem and raised questions that go well beyond the incident itself.
The event began at Kelp DAO, where an attacker identified and exploited a critical flaw in the protocol’s collateral system. To understand what happened, it helps to understand what rsETH is supposed to be. Under normal conditions, rsETH is minted when a user deposits ETH as staking collateral — it functions as a receipt, backed 1-to-1 by the underlying asset. The design is straightforward: deposit real ETH, receive a token representing it.
The attacker found a way around that requirement entirely. By exploiting a flaw in the system, they minted rsETH without depositing any ETH at all — creating tokens that looked legitimate but were backed by nothing.
Those tokens were then deposited as collateral on Aave, one of DeFi’s largest and most trusted lending protocols, and used to borrow real assets: actual ETH, actual stablecoins. The result was up to $230 million in potential bad debt sitting inside a protocol that had no role in creating it.
The exploit itself lasted hours. The damage it triggered is still unfolding.
$15 Billion Left in Three Days. The Numbers Tell the Rest
The market’s response to the exploit was swift and unambiguous. According to XWIN Research Japan, Aave’s total value locked fell from approximately $45 billion to $30 billion in just three days — a 33% decline representing $15 billion in deposits withdrawn by users who decided the risk was no longer acceptable. That pace of exit does not reflect orderly risk management. It reflects fear.
Aave: Exchange Reserve | Source: CryptoQuant
Q&A
What caused the $15 billion loss in DeFi?
The loss was caused by a liquidity shock following an exploit at Kelp DAO, where an attacker minted tokens without depositing ETH.
How did the exploit at Kelp DAO work?
The attacker exploited a flaw in Kelp DAO's collateral system, allowing them to mint rsETH tokens without any actual ETH backing.
What is the impact of the exploit on Aave and other lending protocols?
The exploit resulted in up to $230 million in potential bad debt within Aave, affecting its stability and confidence in the DeFi ecosystem.
What are the broader implications of this DeFi incident?
This incident raises serious concerns about the security and reliability of DeFi protocols, potentially shaking investor confidence across the entire ecosystem.
