DeFi Faces Crisis: Lazarus Claims Signal More KelpDAO Hacks

DeFi’s latest shock is not just the roughly $290 million to $292 million drained from KelpDAO on April 18, 2026. It is the mechanism. Early incident reports tied the exploit to compromised cross-chain verification infrastructure, and LayerZero said on April 20, 2026 that preliminary indicators pointed to North Korea’s Lazarus Group, specifically the TraderTraitor cluster. That matters because the market damage spread far beyond one protocol, hitting Aave liquidity, sector-wide TVL, and confidence in bridged collateral models.

Losses Top $290M as DeFi TVL Drops $13.21B in 48 Hours

The numbers are ugly. KelpDAO’s exploit was reported at about $290 million by Phemex News and The Defiant, while other outlets put the figure at $292 million or $294 million as token pricing shifted across the day on April 20, 2026. That narrow range is normal in fast-moving exploit coverage, but the lower-bound and upper-bound still place it among the largest DeFi breaches of the year. More important, the attack appears to have removed 116,500 rsETH from the system, a figure repeated across multiple reports published between 10:29 UTC and 15:21 UTC on April 20.

Then came contagion. DefiLlama-tracked DeFi TVL fell from $99.497 billion to $86.286 billion in the 48 hours after the April 18 exploit, a decline of $13.21 billion, according to figures cited in market coverage updated on April 20, 2026. That is a 13.28% drop by calculation. Another widely cited snapshot showed a 7% sector decline over 24 hours, which fits the broader two-day drawdown once the second wave of withdrawals is included. In plain English: the market did not treat this as an isolated bridge failure. It priced in systemic collateral risk.

That contagion multiplier, 45.24 times the reported exploit size, is the angle many headlines missed. Competitor coverage focused on the Lazarus attribution and the dollar loss. The more important takeaway is structural: a sub-0.3% hit to pre-shock DeFi TVL triggered a double-digit sector drawdown because the market no longer trusts wrapped collateral once verification assumptions break.

Why the Alleged RPC Compromise Triggered a Much Bigger Liquidity Shock

Here is where the story gets more serious. The Defiant reported on April 20, 2026 that the exploit involved compromised LayerZero RPC nodes feeding data to a verifier, while Coin360-cited reporting said LayerZero described a sophisticated attack engineered to poison downstream RPC infrastructure by compromising a quorum relied on for transaction verification. If that framing holds, this was not a simple smart-contract bug. It was an infrastructure trust failure.

I’ve tracked DeFi exploit cascades since the bridge failures of 2022, and this pattern is familiar in one way and different in another. Familiar because once users suspect collateral is synthetic or unbacked, they run first and ask questions later. Different because the alleged weak point was not just token logic. It was message verification. That distinction matters because dozens of protocols depend on middleware, oracle pathways, relayers, and RPC assumptions they do not fully control.

Aave Hits 100% WETH Utilization While Sector Confidence Breaks First

The sharpest secondary stress showed up on Aave. Multiple April 19-20 reports said the attacker deposited unbacked rsETH into Aave V3 and borrowed about $236 million in WETH against it. That pushed Aave’s WETH pool to 100% utilization, effectively freezing normal withdrawal flexibility for suppliers. One report put Aave outflows above $5.4 billion and another said Aave TVL fell from roughly $26.4 billion to about $17.52 billion or $17.7 billion in two days. Even allowing for timestamp differences, that is a decline of about $8.7 billion to $8.9 billion.

Short sentence. This is the real crisis. DeFi did not just lose funds; it lost liquidity mobility. When a core lending venue hits full utilization in a flagship asset pool, users across unrelated markets start reassessing every derivative token they hold. That’s why the KelpDAO event looks less like a one-off exploit and more like a stress test for shared-pool lending built on rehypothecated staking assets.

Another overlooked detail is scale concentration. One report said the drained 116,500 rsETH represented about 18% of rsETH’s 630,000 circulating supply. By calculation, that is 18.49%. Once nearly a fifth of a liquid restaking asset’s reported supply is implicated in an exploit narrative, every venue accepting that token or its wrappers has to reprice risk immediately.

Can DeFi Contain the Damage if Lazarus-Style Infiltration Claims Spread?

That depends on whether the market sees KelpDAO as an isolated configuration failure or the first visible symptom of a broader operational-security problem. April 2026 has already become the worst month for crypto hacks since February 2025, with reported losses of $606.2 million across 12 incidents, according to market coverage published on April 20. KelpDAO alone accounts for nearly half that monthly total by calculation, between 47.8% and 48.2% depending on whether one uses the $290 million or $292 million estimate.

Data Verification: The exploit size was cross-reported at $290M, $292M, and $294M in coverage published on April 20, 2026. The drained token amount of 116,500 rsETH appeared consistently across multiple reports. DeFi TVL decline figures of 7% in 24 hours and $13.21B over 48 hours are directionally consistent once timestamp differences are accounted for.

If LayerZero’s preliminary attribution to Lazarus or TraderTraitor is confirmed by forensic firms or law enforcement, the significance goes beyond one protocol. It would suggest state-linked actors are not merely exploiting code. They are targeting the human and infrastructure layers around DeFi verification. That’s harder to patch, slower to detect, and much more dangerous for protocols that market themselves as decentralized while depending on narrow operational trust assumptions.