JPMorgan: Kelp DAO hack and flat ETH TVL hurt DeFi

JPMorgan analysts reported Wednesday that a cross‑chain bridge exploit linked to Kelp DAO allowed an attacker to mint $292 million in unbacked rsETH. The attacker used the tokens as collateral on the Aave lending protocol to borrow real ETH, producing roughly $230 million in bad debt and removing about $20 billion from decentralized finance’s total value locked over several days.

Security teams including LayerZero and independent researchers have tied the incident to North Korea’s Lazarus Group. Some of the stolen funds have been frozen, while other amounts continue to move across wallets and through privacy protocols.

The report said the exploit prompted withdrawals from liquidity pools that had no direct exposure to the compromised rsETH, noting how connections between contracts and pools can spread stress. “The incident triggered outflows from pools with no direct exposure to the compromised asset,” the analysts wrote.

Onchain analytics firm CryptoQuant reported a sharp liquidity squeeze across DeFi markets after the exploit, with borrowing rates rising as lenders and borrowers repriced risk. JPMorgan’s team added that overall crypto losses from hacks and exploits so far this year are tracking at a pace similar to 2025.

The analysts observed that smart contract auditing has improved but that cross‑chain bridges remain a persistent attack surface. They distinguished between TVL measured in U.S. dollars, which has broadly followed the wider crypto market, and TVL measured in ETH, which they said has been largely flat.

The report described the flat ETH‑adjusted TVL as a factor limiting the sector’s appeal to institutional investors. It also described a shift in on‑chain holdings toward USDT during periods of stress, stating, “DeFi participants tend to favor USDT, drawn by Tether's deeper liquidity across centralized exchanges and the more immediate off‑ramp it offers during periods of on‑chain stress.”

JPMorgan concluded that persistent security gaps and stagnant ETH‑adjusted TVL continue to curb institutional interest and highlighted concerns about bridge security, protocol interdependence and liquidity under stress.