The KelpDAO exploit resulted in a $292 million loss, triggering a significant bank run on Aave and causing $9 billion to exit DeFi in just one day. The incident raises concerns about the future of decentralized finance.
Key points
KelpDAO exploit resulted in $292 million loss
Aave experienced a bank run with $9 billion exiting DeFi
Total value locked in DeFi fell by $13 billion
Highly sophisticated actors may have used AI for the exploit
3,478.5543 Morning Minute is a daily newsletter written by*Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt.* *And check out our new daily news show covering all of the top stories in 5 minutes or less, downloadable on Apple Pod or Spotify.*
GM!
Today’s top news:
Crypto majors fall then rebound as Iran tensions escalate; BTC at $75.4k
ETFs see $1.4B in inflows on the week, 2nd biggest week of year
DeFi TVL falls by $13B as KelpDAO exploit fallout worsens; AAVE -25%
Vercel CEO says “highly sophisticated” actors used AI for its exploit
Asteroid meme holds at $150M market cap after Elon says “ok” for SpaceX mascot
🔴 $292M Kelp DAO Exploit Triggers Aave Bank Run, $9B Leaves DeFi in a Day
Saturday at 17:35 UTC, an attacker sent a single crafted message to Kelp DAO’s LayerZero-powered cross-chain bridge.
The bridge accepted it as legitimate and released 116,500 rsETH - roughly $292 million and 18% of total circulating supply—to a wallet that had been pre-funded through Tornado Cash ten hours earlier. No ETH ever changed hands on the other side. The rsETH was effectively minted from nothing. The attacker deposited it into Aave V3 and V4 as collateral, borrowed real wrapped ETH against it, and walked.
Aave didn’t get hacked. Its contracts are fine. But it’s now carrying roughly $196M in bad debt it didn’t create, because rsETH had been whitelisted as ETH-correlated collateral—a faulty assumption.
In the aftermath, TVL on AAVE dropped 25% from $26.4B to ~$20B in a single day and continues to fall by the day. Broader DeFi TVL fell by $13B. The AAVE token fell 30%.
ETH depositors trying to withdraw found liquidity at zero, so they started borrowing stablecoins against their deposits to exit—a textbook bank run. SparkLend, Fluid, Upshift, and Lido all froze or paused rsETH exposure. rsETH holders on 20+ chains now have tokens of uncertain backing.
Aave’s own statement Sunday said rsETH on mainnet is “fully backed” but remains frozen “out of an abundance of caution.” But the damage has been done.
Q&A
What caused the $292 million KelpDAO exploit?
The KelpDAO exploit was attributed to highly sophisticated actors, potentially utilizing AI in their attack.
How did the KelpDAO exploit affect Aave?
The exploit triggered a bank run on Aave, leading to a significant drop in its total value locked (TVL) and a 25% decrease in its value.
What is the current state of DeFi after the KelpDAO incident?
Following the KelpDAO exploit, the total value locked in DeFi fell by $13 billion, indicating a severe impact on the sector.
What are the implications of the KelpDAO exploit for the future of DeFi?
The exploit raises serious questions about the security and stability of decentralized finance, potentially affecting investor confidence.
DeFi users are re-evaluating the calculus. Does it make sense to risk exploits for average yield? And now every lending protocol has to reassess security. It will take time to rebuild from this, if it’s even possible.
There have been $600M lost from DeFi via exploits in just the past 3 weeks. And the pace is accelerating…
Key Details:
Kelp DAO’s LayerZero bridgewas exploited Saturday for 116,500 rsETH (~$292M, 18% of supply); attacker minted unbacked rsETH and used it as Aave collateral to borrow real WETH; ~$196M in bad debt left on Aave; AAVE -30%; largest DeFi exploit of 2026
The contagion: Aave froze rsETH and WETH across Ethereum, Arbitrum, Base, Mantle, and Linea; TVL dropped $6.2B in one day; ETH depositors borrowing stablecoins to exit triggered a bank run dynamic; SparkLend, Fluid, Upshift, and Lido all froze rsETH exposure
The structural issue: LRT tokens like rsETH were whitelisted as near-ETH collateral on Aave, Compound, and Euler; this exploit assumes backing was intact at all times; it wasn’t; every DeFi lending protocol now needs to reassess liquid restaking token collateral risk
🌊 BTC Hit $78K; Then Iran Closed Hormuz Again
Friday was the most violent 24 hours in crypto markets since the war started.
Iranian FM Araghchi posted that the Strait of Hormuz was “fully open to all commercial vessels.” Trump followed on Truth Social claiming Iran agreed to an “unlimited” suspension of its nuclear program and said a permanent deal was “mostly complete.”
Bitcoin ran from $74.5K to $78,400 - its first print above $78K since February 4. Oil crashed nearly 10% to ~$82/barrel. The S&P 500 closed at a record 7,121. There were $600M+ in crypto short liquidations. The ETFs posted ~$800M+ in inflows, the biggest in months.
The vibes were euphoric.
By Saturday morning, tanker owners were receiving Iranian radio transmissions closing the strait. State media said Hormuz had returned to “strict management and control.” BTC pulled back to ~$74K giving back its recent gains, Oil rebounded to $90 and stock futures are red.
And a return to war looks more likely than ever…
📅 Saylor Wants to Pay STRC Dividends Twice a Month
Strategy filed a preliminary proxy Thursday proposing to shift STRC dividend payments from monthly to semi-monthly.
The annual rate stays at 11.5%, and the $1.2B total obligation is unchanged. Holders would just receive smaller checks every two weeks instead of one larger check per month. If approved, the first semi-monthly payment lands July 15.
Strategy is proposing to pay semi-monthly dividends on $STRC, instead of monthly. No change to the annual dividend obligations or dividend rate. These proposed changes are intended to stabilize price, dampen cyclicality, drive liquidity, and grow demand. pic.twitter.com/jHFRaDz6oP
The reason this matters can be seen in the STRC price action over the past few months. Leading up to the dividend cut off date of the 15th, STRC trades at or above its $100 par with increasing volume until the 14th. Then it goes sub-par for a few weeks as traders no longer need to hold for the dividend. Around the 1st of the month, it hits $100 par again and the cycle repeats.
Well with semi-monthly dividend payments, Saylor could potentially erase that 2-week period where STRC trades sub-par. That would mean more potential capital for him to use to buy Bitcoin - and a safer hold for those holding STRC.
Assuming this goes through, expect Bitcoin to benefit (and maybe even bigly)…
🚀 A Dying Girl’s Wish Made a Meme Coin Worth $175M
Liv Perrotto was 15 years old when she died of cancer in January. Before she passed, she had designed a plush Shiba Inu named Asteroid that flew aboard SpaceX’s Polaris Dawn mission in 2024 as the zero-gravity indicator. Her dying wish was simple: she wanted Elon Musk to make Asteroid the official SpaceX mascot.
Radio host Glenn Beck posted her story on X Thursday night. Elon replied “Will answer shortly” at 11:50 PM ET. That response alone was enough to send the ASTEROID meme coin to a $30M+ market cap.
But traders anxiously awaited Elon’s response. On April 18 in the afternoon, they got it. Elon answered the girl’s questions for him and replied “OK” to the SpaceX final item, confirming Asteroid as the official SpaceX mascot.
The token immediately sent to $100M+ in market cap within hours, reaching $190M+ overnight. It’s now trading near $155M.
Now the question becomes—will Elon continue leaning in and actually make Asteroid Shiba the SpaceX mascot? Or was this a one off response?
🌎 Macro Crypto and Markets
Crypto majors are red but rebounding after a big Sunday selloff; BTC -0.1% at $75.4k; ETH -1% at $2,316; SOL flat at $85; HYPE -4% at $41.30
SKY (+5%), CC (+4%) and M (+7%) led top movers
Oil +2% at $88; Gold even at $4,780
Stock futures redafter record-breaking green streak
Vercel’s CEOconfirmed a breach traced to a compromised third-party AI tool (Context.ai), which gave attackers access to internal Vercel environments via a hijacked Google Workspace account; CEO Guillermo Rauch called the actors “highly sophisticated” and said they may have used AI to accelerate the intrusion
Coinbase is deploying AI agents modeled after legendary former executivesdirectly into Slack and email; “Fred” is based on co-founder Fred Ehrsam and acts as a strategic planning agent; “Balaji” is modeled after former CTO Balaji Srinivasan and is designed to challenge assumptions and spark innovation
