Decentralized finance is reeling from one of its most severe liquidity crises in recent memory, with $15 billion in value wiped out over three days. The turmoil began on April 19 when an attacker exploited a critical vulnerability in Kelp DAO's collateral system, minting rsETH tokens without depositing any underlying ETH.
The exploit's impact reached far beyond the initial breach. Those illegitimate tokens were then deposited as collateral on Aave, one of DeFi's most trusted lending protocols, enabling the attacker to borrow real assets including ETH and stablecoins. The incident has triggered a system-wide confidence shock that raises questions about the interconnected vulnerabilities within the ecosystem.
The attacker bypassed Kelp DAO's core design mechanism, under which rsETH is normally minted only when users deposit ETH as staking collateral. By creating tokens backed by nothing that appeared legitimate, the attacker exploited a fundamental flaw in the verification process. This allowed them to extract genuine value from multiple protocols simultaneously.
The cascading effect has rattled market participants and highlighted the systemic risks posed by DeFi's interconnected lending infrastructure. Protocols that accepted the fraudulent collateral are now exposed to significant losses, potentially triggering further liquidations and eroding trust in cross-platform composability.
Industry observers warn this incident exposes structural weaknesses in DeFi's trust model, where a single protocol breach can propagate through the entire ecosystem. The scale of the loss suggests deeper liquidity fragmentation issues that may require fundamental redesigns of collateral verification systems.