The decentralized finance (DeFi) market underwent a rapid repricing of credit risk last weekend following a major exploit on the Kelp DAO cross-chain bridge, according to coindesk.com.
On April 18, an attacker exploited Kelp DAO’s LayerZero-powered bridge to mint approximately 116,500 unbacked rsETH tokens. These synthetic tokens, worth about $292 million, were used as collateral on Aave to borrow an estimated $190 million to $230 million in real assets.
The incident triggered massive contagion across interconnected protocols. Within 48 hours, net outflows from Aave reached between $6 billion and $10 billion, as the protocol's utilization for WETH, USDT, and USDC pools hit 100%.
This liquidity crunch forced many users into desperate positions. Some depositors found themselves unable to withdraw, while others borrowed an additional $300 million against their own locked stablecoin deposits at 75% loan-to-value ratios just to access cash.
A shift in yields
Before the exploit, the market appeared to be mispricing risk. Aave's stablecoin lending rates sat at just 2.32% APY, a figure lower than the Federal Reserve's 3.64% overnight rate.
Following the exploit, Aave stablecoin deposit APYs surged from 3–6% to 13.4% in two days. Similar ripples were felt in other vaults; Morpho's USDC vault, which powers Coinbase's consumer loan product, jumped from 4.4% APR to 10.81% the following day.
Di Bartolomeo, writing for CoinDesk, noted that the market achieved a feat that no regulator or auditor has ever accomplished: it repriced DeFi credit risk in real time.
"The mispricing is over. Last weekend proved it," Di Bartolomeo stated.
The exploit highlighted structural vulnerabilities in how DeFi handles collateral. While Aave's incident report noted the protocol functioned as designed, the shortfall was structural. Kelp and LayerZero have since traded blame regarding the validator configuration that allowed the exploit.
Unlike regulated finance, DeFi lacks a formal bankruptcy process or legal recourse. In the event of a protocol failure, there is no court to claw back funds from those who withdrew first. This lack of a recovery process creates a high-stakes environment where the speed of a user's movement determines their exposure to loss.
