DeFi is back to doing what it does worst at critical times: promising returns from the financial future and then reminding users that the infrastructure, under pressure, is still frighteningly fragile. On 18 April, an attacker stole some 116,500 rsETH from the LayerZero-based Kelp DAO bridge, worth close to $292 million, or about 18 per cent of the token’s circulating supply. It was not only one of the biggest DeFi exploits of the year, but an event that immediately contaminated the rest of the industry, dragging with it protocols that had not been breached directly but were found to be exposed to the same systemic contagion.
According to the reconstructions that emerged, the attacker abused the cross-chain messaging layer to process a fraudulent instruction and release funds to a controlled wallet, pre-funded via Tornado Cash. The real wound, however, opened minutes later, when the stolen rsETH was deposited on Aave V3 as collateral to borrow wrapped ether, generating some $196 million in bad debt and prompting the protocol to freeze the markets exposed to the asset. Aave was not punctured, but in the market, the distinction between direct blame and actual damage is short-lived: its TVL lost about $6.6 billion and the token suffered a double-digit collapse.
It is here that the Kelp DAO case stops being a crime story and becomes a political issue for the whole ecosystem. Cross-chain bridges continue to be where DeFi focuses its greatest ambition and most chronic weakness: connecting different worlds without introducing disproportionate risk. Yet each new exploit tells the same uncomfortable truth, namely that the composability between protocols amplifies not only the returns, but also the speed with which the damage spreads. The attack on Kelp came on the heels of the $285-286 million hit on Drift Protocol on 1 April, which was attributed by multiple analysts to entities linked to North Korea, confirming that April 2026 is already one of the worst months for recent crypto security.
For those observing the industry with a modicum of historical memory, the question is not whether DeFi will survive. It will survive, as Bitcoin has survived every media funeral, and as Ethereum has already demonstrated its ability to turn technical crises into cycles of innovation. But not all survival is equal. If every new yield season is accompanied by bridges blowing up, toxic collateral and billions evaporating in a matter of hours, then the problem is no longer the hack itself: it is the trust model that DeFi continues to demand from its users without having yet finished deserving it. And at that point the market will do what it does best: it won’t listen to sermons, it will only look at the blood on the ground.
