$293M Hack Leads to Run on DeFi Platforms

A $293 million hack led to a bank-run style withdrawal frenzy on leading decentralized finance lending protocol Aave, which saw some $10 billion pulled from its liquidity pools over the weekend.

In all, more than $13 billion in total value locked (TVL) has been withdrawn from DeFi projects.

The trouble began when the KelpDAO’s LayerZero-powered bridge was hacked on April 18. That allowed attackers to use stolen rsETH — what’s known as a liquid restaking token — as collateral for loans on a variety of projects, with Aave getting the lion’s share.

A bridge is a protocol that allows users to take one type of token, such as ether (ETH) tokens, and borrow other tokens, like rsETH, that can be used in DeFi investments without selling the original token. However, that leaves the original token locked in the bridge, which can be hacked. That makes them a favorite target of sophisticated hackers.

Billions of dollars have been lost to bridge hacks over the years. Many, like KelpDAO, have been attributed to state-backed North Korean hackers.

Given that KelpDAO didn’t lose tokens so much as have new ones minted without any backing collateral, Aave and other DeFi platforms’ users are concerned that those protocols will take the financial hit for bad debt.

Marc Zeller, a well-known figure in the Aave community, urged Aave users to “withdraw now, ask questions later,” on Saturday. Withdrawals have since been paused on Aave and other DeFi protocols.

The Ethereum-based KelpDAO hack comes just weeks after a $285 million exploit of Solana-based Drift, further damaging trust in the $90 billion DeFi sector. $483 million was lost to hacks and exploits in the first quarter of 2026.

In all, more than $750 million has been lost to hackers this year, with more than $575 million in April alone.

LayerZero blamed KelpDAO for the loss, saying that its system did not have any redundancies to check if cross-chain messages were verified, making a single point of failure. LayerZero said that it had warned KelpDAO about this potential problem in the past.