DeFi TVL slides 14% since KelpDAO exploit as risk appetite retreats

Total value locked across DeFi categories has continued to decline, down roughly 14% since mid-April, falling from approximately $172 billion to $148 billion.

The inflection point coincides with the KelpDAO bridge exploit on April 18, which has since cast a longer shadow over broader DeFi sentiment than the incident alone might suggest.

On April 18, attackers reportedly linked to North Korea's Lazarus Group exploited KelpDAO's LayerZero bridge, stealing approximately $292 million (116,500 rsETH) through a compromise of off-chain infrastructure rather than a smart contract vulnerability.

The attack manipulated internal RPC nodes and overwhelmed external validators to feed false data into a single-point-of-failure verification setup, tricking the destination chain into releasing funds against a phantom burn on the source chain.

Lending, the largest DeFi category, has seen the steepest drawdown, declining from approximately $53 billion to $40 billion over the period. Liquid restaking protocols have also seen notable declines.

The persistence of the outflows, now over five weeks, points less to a technical re-rating of specific protocols and more to a broader withdrawal of marginal capital. Users who exited following the exploit have largely not returned, consistent with a pattern where high-profile infrastructure failures reduce risk appetite across the sector rather than staying contained to the affected protocol.

The KelpDAO attack is a useful data point on the evolving threat surface in DeFi. As smart contract security has improved, off-chain infrastructure has become a more exploitable layer, a risk that existing monitoring frameworks are still catching up to.