Kelp DAO Exploiter Routes $80M Through THORChain as Aave Loses $15B
On-chain analysts have confirmed that the Kelp DAO exploiter laundered approximately $80 million in stolen ETH through THORChain over a 24-hour window, with swap volume on the cross-chain protocol surging to $394 million — more than eleven times its typical daily volume of under $35 million. The laundering activity follows the $292 million rsETH bridge exploit on April 18, now attributed by LayerZero to North Korea’s Lazarus Group subunit TraderTraitor. RUNE climbed 18.11% in 24 hours to $0.502, a grim reflection of the volume flowing through the protocol.
Aave Bears the Brunt as Core Markets Seize Up
The contagion radiating from the exploit hit Aave harder than any other protocol. The attacker deposited the fraudulently minted rsETH as collateral, borrowed close to $200 million in WETH, and triggered a withdrawal stampede once the unbacked collateral was discovered. Over $6.6 billion exited Aave within a single 24-hour period, with Justin Sun and exchange MEXC among the notable large withdrawals. Cumulative outflows over three and a half days reached $15.1 billion, collapsing Aave’s TVL from $48.5 billion to approximately $30.7 billion.
The ETH, USDT, and USDC lending pools all reached 100% utilization, trapping an estimated $5 billion in stablecoins with no viable withdrawal path. CertiK’s senior blockchain security analyst Natalie Newson was direct about what that means in practice: “100% utilization doesn’t just mean a lack of liquidity; it means the protocol’s self-defense systems are down.” Bad debt projections from risk firm LlamaRisk range from $123.7 million to $230.1 million. Aave’s governance moved to freeze rsETH reserves and reduce loan-to-value ratios to zero, but the capital had already fled. When contacted by CoinDesk, Aave founder Stani Kulechov offered only: “I do not have anything useful to say.” AAVE trades at $93.40, up 1.05% on the day, though that figure tells little about the structural damage underneath.
Bitcoin BTC$62,212.00▼0.27%
Ethereum ETH$1,657.90▼0.91%
Tether USDT$0.9992▼0.03%
BNB BNB$593.88▼0.31%
USDC USDC$1.0000▲0.04%
XRP XRP$1.13▼2.49%
Solana SOL$65.19▼1.20%
TRON TRX$0.3229▲0.11%
Figure Heloc FIGR_HELOC$1.03▲0.49%
Dogecoin DOGE$0.0848▼1.06%Egorov Calls for Standards as Laundering Trail Points to Lazarus
Curve Finance founder Michael Egorov used the crisis to push a harder argument: that preventable failures keep repeating because the industry lacks shared safety frameworks. “We should probably come together and develop safety standards for DeFi,” he wrote. “How to build safely, and how to verify safety. Probably everyone should bring their best practices, and the projects, auditors, and risk assessment groups should know them.” He proposed that the Ethereum Foundation and Solana Foundation could convene the effort, and drew attention to the blame-shifting between Kelp DAO and LayerZero as evidence of a structural accountability gap — not just a one-off failure.
The laundering pattern, documented by ZachXBT and Arkham Intelligence, includes a smaller portion routed through Umbra, a privacy protocol, alongside the dominant THORChain flows. Analysts note the methodology closely resembles prior Lazarus Group operations, though formal attribution remains unconfirmed. A forensic report from Kelp DAO and resolution of Aave’s bad debt from tainted collateral are the two near-term signals that will determine whether the broader contagion stabilizes. Egorov’s demand for industry standards is the right instinct — but as aggregate DeFi losses approach $1 billion across recent weeks, the question is whether that instinct converts into coordinated action before the next misconfigured verifier node hands an attacker another $293 million.
