The KelpDAO hack is finally reaching a conclusion as of today.
JPMorgan released a report on Wednesday, stating succinctly: the interconnectedness of DeFi poses systemic risks when things go south.
Let's break down how precise this attack was—
The attacker targeted the LayerZero validation nodes of the KelpDAO cross-chain bridge.
The cross-chain bridge used a 1-of-1 single validator architecture, and LayerZero had warned Kelp that this configuration was problematic.
The result is that Kelp hasn't changed; Lazarus has forged cross-chain messages out of thin air, minting 116,500 rsETH, which makes up 18% of the circulation.
So what now?
They took this batch of worthless rsETH to Aave as collateral, borrowing real ETH.
Aave suddenly faced nearly $200 million in bad debt, forcing them to freeze the rsETH markets in V3 and V4.
This is just the direct loss.
The scary part is the contagion effect.
In just 48 hours, the total DeFi TVL plummeted by $13 billion, with over $6 billion flowing out from Aave alone.
JPMorgan's data is even more shocking; factoring in subsequent panic exits, the entire DeFi TVL evaporated by $20 billion.
Pools of funds that have nothing to do with rsETH are also exiting, purely due to a collapse of trust.
This is the price of DeFi's composability.
In a bull market, everyone calls this 'Lego blocks', but when things go south, it's just a game of dominoes.
As soon as one bridge's validation node is sorted, the entire bad debt can transfer from Kelp to Aave, and panic can spread from Aave throughout DeFi.
A data point mentioned in JPMorgan's report: in ETH terms, DeFi TVL has basically not risen from 2021 to now.
The growth measured in USD is entirely supported by the coin prices.
Institutions see this data, and with occasional hacker incidents, why would they be foolish enough to think about entering the market?
The choice of funds is quite straightforward.
After the incident, a massive influx of funds moved to USDT, mirroring the traditional market's rush for cash during panic.
USDT's liquidity depth on CEX and its exit channels on-chain have made it the go-to safe haven for DeFi players.
Interestingly, this wave of risk aversion hasn't yet reflected in USDT's market cap, indicating that funds are being pulled from DeFi protocols into stablecoins, with no new money coming in overall.
Direction assessment: The short-term DeFi sector remains under pressure, with ETH stuck in the 2300-2400 range, and this is closely related to the situation.
Trust restoration in the cross-chain bridge sector takes time; before Aave's bad debt resolution plan is out, the TVL inflow to lending protocols will be very slow.
The North Korean Lazarus group is getting increasingly savvy with DeFi, and attacks are becoming more frequent; almost the entire crypto space is turning into their ATM, and no one knows if their money will be next to suffer, which is the most chilling part.
$BTC $ETH #Kelp event wrap-up, Aave's TVL drops below $30 billion #NewbieGrowthCamp #CreatorIncentives