---

On April 18, attackers drained approximately $292 million worth of rsETH from KelpDAO by exploiting a vulnerability in its LayerZero bridge configuration. The attackers poisoned RPC nodes that LayerZero's message verifier depended on and used DDoS traffic to push the verifier onto compromised infrastructure. This allowed them to mint roughly 116,500 unbacked rsETH tokens, representing about 18% of total circulating supply, which were then distributed across more than 20 blockchain networks. LayerZero has attributed the attack to TraderTraitor, a subunit of the Lazarus Group, a North Korean state-linked hacking operation also responsible for a separate Drift Protocol exploit on April 1. Combined losses attributed to the group now exceed $575 million across 18 days.

The damage extended well beyond KelpDAO. The attacker deposited 89,567 rsETH on the Aave V3 lending protocol as collateral and borrowed approximately 82,650 WETH and 821 wstETH before the collateral lost value. This left Aave with an estimated $177 million in confirmed bad debt on its WETH lending pool, with potential losses reported as high as $230 million in subsequent industry analysis. By contrast, Morpho Protocol's isolated vault model limited rsETH-related losses to approximately $1 million across just two of roughly 500 vaults, drawing renewed attention as a structural alternative to shared liquidity pools. Aave's total TVL dropped from $26.4 billion to $20.7 billion within two days as users pulled funds. Across DeFi as a whole, $13.21 billion in total value locked was erased in the same 48-hour window.

A public dispute between the two protocols has complicated the fallout. LayerZero stated that KelpDAO used a single-verifier bridge configuration against explicit guidance. KelpDAO pushed back, arguing that the vulnerable setup was built on LayerZero's own default infrastructure, not a configuration the team chose independently. The disagreement has yet to be resolved, and it raises questions, at minimum as a matter of authorial framing, about where responsibility lies when bridge defaults are themselves insecure.

Curve's weekly numbers tell a sharply different story. TVL held at $2.05 billion, down only 1.9%, while DEX volume surged 235.2% week-over-week to $2.14 billion as traders rotated liquidity during the crisis. Fees climbed 186.4% to $476,000, reflecting elevated swap activity. The most notable signal came from crvUSD: minted supply rose 41.1% to $27 million while the stablecoin held its $1.00 peg throughout. Peg stability reserves jumped by $108 million to $146 million total, indicating that market participants were moving capital into crvUSD buffers rather than fleeing the protocol. Llamalend, Curve's lending arm, also grew during the period, with TVL rising 15.7% to $128 million, borrowed volume up 20.1% to $69.6 million, and collateral climbing 25.6% to $110 million — a particularly meaningful signal given that the week's defining crisis centered on collateral risk.

"It's been a hard week for the industry, with the LayerZero hack affecting KelpDAO's rsETH reverberating throughout DeFi," wrote Saint Rat of Curve Finance in the protocol's Week 17 report. "Fortunately, Curve has fared well, with TVL down only 1.9% to $2.05B." Elsewhere in the same report, Saint Rat added: "crvUSD also held up exceptionally well, with minted supply increasing by 41% while staying firmly on peg. This is a good time for reflection, to harden security, and reevaluate all trust assumptions."

The best-performing yield pools this week include USDC/sJUSD at 20.4% APY on Ethereum, two ynRWAx pools at 17.1% and 15.1% APY, and a crvUSD/sfrxUSD pool on Fraxtal at 14.9% APY. Two of the top three pools involve ynRWAx (YieldNest RWA MAX), a yield-bearing token backed by mortgage-based private credit in Tier-1 jurisdictions, layered with Curve LP rewards and StakeDAO auto-compounding incentives. This fits a broader market trend: tokenized real-world assets have grown to $25 billion globally as of March 2026, spanning treasuries, commodities, and private credit. A note of caution applies to the top-yielding USDC/sJUSD pool specifically. The sJUSD token could not be independently verified through CoinGecko, DefiLlama, or official project documentation at time of publication. Higher yields in smaller, less-documented pools frequently reflect lower liquidity and elevated risk. Users should verify the pool's underlying contract and token issuance before allocating capital.

For DeFi participants in South Asia and Sub-Saharan Africa, where platforms like Curve serve genuine financial utility beyond speculation, the week carries practical lessons. India ranks first globally in the 2026 Crypto Adoption Index for the sixth consecutive year, Pakistan ranks eighth globally with strong retail and DeFi participation, and Nigeria ranks second overall and first in DeFi value. Stablecoin transaction volumes across Sub-Saharan Africa topped $205 billion in the year ending mid-2025, a figure representing more than 180% year-over-year growth, with Nigeria, Ethiopia, Kenya, and Ghana all placing in the global top 20 for crypto adoption. Traditional remittance fees to the region still average 8.78% per transaction versus roughly 0.5 to 1% for stablecoin transfers, which gives DeFi protocols meaningful real-world relevance in these markets. The KelpDAO collapse demonstrates that collateral provenance matters: yield strategies built on bridged assets carry bridge security risk that retail participants across all regions may not fully price in.

On the governance front, Curve's DAO is currently voting on two measures with broader implications. One would remove Aave's GHO stablecoin from crvUSD's PegKeeper system, citing counterparty exposure concerns following Aave's bad debt event. The other would sunset select Llamalend markets with rsETH collateral exposure. Both votes are best understood as risk management ahead of Llamalend V2, which will support LP tokens and principal tokens as collateral and integrate with FXSwap, Curve's planned on-chain foreign exchange product. How Curve and other protocols incorporate the lessons of this week into their V2 designs will be a key story to watch through the rest of 2026.