DeFi TVL Dropped $13B in April; Leverage Ratio Rose to 38%

The KelpDAO incident spread pressure across connected lending markets. Binance Research said the exploit created roughly $230 million in bad debt on Aave, a leading Ethereum-based lending pool, and cut Aave's TVL by half. Stolen collateral entered Aave's pools, dragging down the protocol's position. The event showed how a single bridge failure can move through DeFi when the stolen assets hit lending markets.

KelpDAO completed the operational part of its rsETH recovery plan. The protocol sent a final batch of 20,373.7 rsETH to the LayerZero smart contract used for cross-chain transfers. Minting, redemptions, and reward functions were operating normally after earlier restart steps, it said. The recovery steps reduced direct pressure on KelpDAO users but did not fix the wider leverage concern.

Security incidents continued after April, though reported losses dropped. CertiK put May hack losses at $68.3 million, down nearly 90% from April's roughly $650 million. Still, attacks kept hitting bridges, legacy contracts, private keys, and operational controls.

Humanity Protocol said more than $36 million was stolen after attackers compromised administrative keys linked to its bridge systems. Aztec Connect lost about $2.1 million from an old immutable contract. Raydium said it would reimburse users after a $1.3 million exploit hit five legacy Solana liquidity pools.

Binance Research said "meaningful deleveraging has yet to materialize."