MagazinAisle

Category: Business

  • An Altcoin Will Be Blamed for the Major Crypto Hack That Occurred Over the Weekend – Revealed in the Memos

    An Altcoin Will Be Blamed for the Major Crypto Hack That Occurred Over the Weekend – Revealed in the Memos

    A new development has emerged in the large-scale security breach crisis originating from KelpDAO. According to an internal memo reviewed by CoinDesk, KelpDAO is allegedly preparing to shift responsibility for the approximately $292 million rsETH breach that occurred on Saturday to LayerZero.

    According to the memo, KelpDAO stated that it relied on LayerZero’s documentation, default configurations, and team guidance when building its bridging infrastructure. Therefore, it is implied that the infrastructure and integration processes used were at the root of the security breach.

    Related News JUST IN: U.S. President Donald Trump Makes a Statement on the Iran Ceasefire – “The Likelihood of an Extension Is Very Low”

    As you may recall, the security breach on the rsETH bridge triggered a chain reaction in the DeFi ecosystem, leading to liquidity pressure and “bad debt” concerns in many protocols, particularly Aave. Following the incident, billions of dollars worth of assets were withdrawn from Aave, and utilization rates in some pools reached 100%.

    KelpDAO’s move, which points to LayerZero, has raised potential legal and technical liability issues, but neither party has yet issued an official and detailed statement.

    *This is not investment advice.

  • Bitcoin faces near-term pressure as liquidity tightens, Hilbert Group CIO says

    Bitcoin faces near-term pressure as liquidity tightens, Hilbert Group CIO says

    Global liquidity is set to deteriorate sharply, according to Russell Thompson, chief investment officer at crypto asset manager Hilbert Group (HILB), who said even a quick geopolitical resolution in Iran is unlikely to sustain a rally in risk assets without policy support.

    Liquidity conditions have stabilized in parts of the financial sector following the rollout of the reserve maturity program (RMP), Thompson said, but a broader tightening of 20%–25% is approaching, a significant drag that could leave bitcoin struggling in the near term.

    “Even with a resolution quickly in Iran, I do not believe that risk assets will rally for any sustainable time without outside help,” Thompson said in the report published last week.

    Thompson said he expects U.S. policymakers to respond. He pointed to likely measures including reform of the supplementary leverage ratio (SLR), a sizable drawdown of the Treasury General Account (TGA) without offsetting Federal Reserve bill issuance, and a series of rate cuts under a potential new Fed chair.

    The SLR is a banking regulation that sets how much capital large banks must hold against their total leverage. The TGA is the U.S. Treasury’s main cash account at the Federal Reserve.

    When the Treasury draws down the TGA (spends money from it), liquidity is effectively injected into the financial system; when it builds the TGA, liquidity is drained.

    Bitcoin’s performance over the past six months has been marked by sharp volatility, a clear shift from late-2025 exuberance to a more fragile, macro-driven market.

    After hitting an all-time high above $126,000 in October 2025, bitcoin entered a sustained drawdown through the end of the year and into early 2026. By February, prices had fallen to roughly $63,000, a decline of about 50% from the peak, amid a broader crypto market sell-off and tightening financial conditions. This period was characterized by weaker demand, exchange-traded fund (ETF) outflows and a more risk-off macro backdrop, with BTC underperforming equities in some stretches.

    Bitcoin is currently trading around $75,600, leaving it significantly off its peak but no longer in freefall. The last six months, in short, have seen a full cycle: from peak euphoria, to a deep correction, to a tentative stabilization phase, with macro liquidity, policy expectations and investor positioning now the dominant drivers.

    Advances in crypto regulation could also provide support. Thompson said he anticipates legal clarity on key measures before the summer recess and a faster-than-expected expansion of the Fed’s balance sheet as disinflationary pressures build.

    Higher oil prices, he argued, could ultimately weigh on growth, while a softening labor market and emerging stress in private credit may add to the disinflationary backdrop.

    Markets remain overly focused on the Federal Reserve as the primary source of liquidity, Thompson said, but the U.S. Treasury has significant capacity to inject funds into both the real economy and financial markets. With Treasury leadership experienced in deploying such tools, he expects a more proactive approach.

    The result: short-term pressure on bitcoin, but improving conditions over the medium term.

    Thompson said he expects bitcoin to be “significantly higher” by year-end as liquidity dynamics evolve. Even in a more protracted scenario, he sees liquidity bottoming around 2027, a timeline that could coincide with fresh all-time highs.

    Read more: U.S. crypto adoption is rebounding, bitcoin still dominates, Deutsche Bank says

  • Five times President Trump made a statement that moved bitcoin, and why it might happen again this week

    Five times President Trump made a statement that moved bitcoin, and why it might happen again this week

    Bitcoin and other risk assets have become increasingly sensitive to statements from U.S. President Donald Trump, with markets often swinging upward or downward within minutes of his social media posts or policy announcements to the news media.

    This has drawn scrutiny from lawmakers, academics and market experts, as questions mount over whether those price movements have created lucrative opportunities for market manipulation or insider trading.

    A recent University of Oxford Faculty of Law study found sharp swings in global markets following rapid changes in U.S. tariff policy, including a sequence in which prices across crypto and stock markets fell after new tariffs were announced, then rebounded after Trump partially rolled them back days later.

    The scale and timing of those moves, the author noted, created “fantastic trading opportunities” for anyone with advanced knowledge of the decisions. Also, those back-and-forth decisions by Trump have been widely criticized and called the Trump Again Chickens Out (TACO) dynamic.

    ‘A great time to buy’

    The issue gained further attention after Trump posted “THIS IS A GREAT TIME TO BUY!! on Truth Social in April 2025 shortly before announcing a tariff adjustment that sent markets higher, prompting calls from lawmakers, including Senator Adam Schiff, for an investigationinto potential insider trading or market manipulation.

    Analysts, experts and media reports have highlighted patterns of large, well-timed trades across commodities and prediction markets, in some cases placed minutes before major policy or military announcements.

    “Many experts say the Trump administration has engaged in market manipulation,” according to a March episode of CBC’s Front Burner, which pointed to unusually massively profitable trades in oil futures ahead of announcements related to the war with Iran.

    Democratic Congressman Stephen Lynch raised similar concerns. He said trading activity tied to major Trump announcements “raised serious concerns about insider trading and market manipulation by government officials in possession of sensitive national security information.”

    There is no evidence that Trump or his administration have violated securities laws or purposely manipulated the markets for self gain, but the increasing number of unusually well-timed market moves, combined with the administration’s direct influence over policy, geopolitics and regulation, has fueled a broader debate over whether the line between political decision-making and market impact is becoming increasingly blurred.

    Here are five top moments when bitcoin’s price swung either up or down due to a statement or social media post by Trump, from the “Genesis” skepticism of 2019 to the naval blockades of 2026.

    The top five BTC price swings

    1. July 11, 2019 — The “Not a Fan” Genesis Post. In his first direct broadside against the asset class, Trump posted on Twitter: “I am not a fan of Bitcoin and other Cryptocurrencies, which are not money… and based on thin air.” Bitcoin dropped 7.1% within 45 minutes of the thread.

    2. March 3, 2025 — The Strategic Reserve Pivot. Following a year of pro-crypto campaigning, Trump confirmed via Truth Social that his “Strategic National Crypto Reserve” would include a multi-asset basket of cryptocurrencies, most notably bitcoin. Bitcoin surged 8.2% in under 24 hours, jumping from $84,000 to over $91,000.

    3. October 10, 2025 — The 100% tariffs on China. In yet another Truth Social post, Trump announced a 100% tariff on all Chinese imports to counter Beijing’s rare-earth export controls. Bitcoin plummeted 12.4% in roughly two hours, crashing from its $124,714 all-time high toward $102,000. And in 24 hours, a $19.38 billion liquidation event had taken place, marking the largest single-day wipeout in the asset’s history.

    4. March 3, 2026 — The Anti-Bank “Genius Act” Post. Trump took to Truth Social once again to criticize Wall Street banks for “undermining” the Genius Act and delaying the passage of the Clarity Act over stablecoin yield provisions. Bitcoin rose 5.2% in 10 minutes to $71,000. This moment highlighted the administration’s willingness to go to war with the legacy financial system to protect the crypto sector.

    5. April 14, 2026 — The Peace Talks. Following the naval blockade of the Strait of Hormuz, Trump said that Iran had “reached out” for potential peace talks and that a deal was “very possible.” Bitcoin rose 6.2% within 30 minutes from $70,000 to nearly $75,000.

    It might happen again

    Bitcoin shot to a more than two-month high above $78,000 on Friday after Trump essentially announced the end of the war and the full reopening of the Strait of Hormuz. Yet, by the end of the day, there were already questions about exactly what the U.S. and Iran had agreed to.

    By Saturday morning, Iran’s military said the Strait was again closed, and there were reports of some ships making U-turns and others being fired upon. Crypto prices were quickly giving back Friday’s gains, with bitcoin sliding back below $76,000.

  • LayerZero Pins $292M KelpDAO Bridge Hack on North Korea’s Lazarus Group

    LayerZero Pins $292M KelpDAO Bridge Hack on North Korea’s Lazarus Group

    In brief

    • Attackers drained roughly $292M from KelpDAO’s cross-chain bridge on Saturday.
    • LayerZero, which powered the breached bridge, tied the hack to North Korea’s Lazarus Group.
    • The bridge itself wasn’t broken, but attackers corrupted the channel verifying it, Decrypt was told.

    The exploit that drained roughly $292 million from KelpDAO’s cross-chain bridge over the weekend was “likely” the work of North Korea’s Lazarus Group, specifically its TraderTraitor subunit, LayerZero said in a preliminary analysis on Monday.

    Attackers drained 116,500 rsETH, a liquid restaking token backed by staked ether, from the KelpDAO bridge on Saturday, setting off withdrawals across the decentralized finance sector that pulled more than $10 billion out of lending protocol Aave.

    The attack carried the markings of “a highly-sophisticated state actor, likely DPRK’s Lazarus Group,” LayerZero said, specifying the group’s TraderTraitor subunit.

    North Korea’s cyber operations run under the Reconnaissance General Bureau, which houses several distinct units, including TraderTraitor, AppleJeus, APT38, and DangerousPassword, according to an analysis by Paradigm researcher Samczsun.

    Among these subunits, TraderTraitor has been flagged as the most sophisticated DPRK actor targeting crypto, previously linked to the Axie Infinity Ronin Bridge and WazirX compromises.

    LayerZero said that KelpDAO had used a single verifier to approve transfers in and out of the bridge, adding that it had repeatedly urged KelpDAO to use multiple verifiers instead.

    Going forward, LayerZero said it will stop approving messages for any application still running that setup.

    A single point of failure

    Observers say the exploit exposed how the bridge was built to trust a single verifier.

    It was “a single point of failure, regardless of what the marketing calls it,” Shalev Keren, co-founder at cryptographic security firm Sodot, told Decrypt.

    A single compromised checkpoint was enough to allow the funds to leave the bridge, and no audit or security review could have fixed that flaw without “removing unilateral trust from the architecture itself,” Keren said.

    That view was echoed by Haoze Qiu, Blockchain Lead at Grvt, who argued that, “Kelp DAO appears to have accepted a bridge security setup with too little redundancy for an asset of this scale,” adding that LayerZero “also has accountability” given that “the compromise involved infrastructure tied to its validator stack, even if this was not described as a core protocol bug.”

    The attackers came within three minutes of draining another $100 million before a rapid blacklist cut them off, according to an analysis by blockchain security firm Cyvers. The operation was based on tricking a single channel of communication, Cyvers CTO Meir Dolev told Decrypt.

    Attackers tapped two of the lines the verifier used to check whether a withdrawal had actually occurred on Unichain, fed it a fake “yes” on those lines, then knocked the remaining lines offline to force the verifier to rely on the compromised ones.

    “The vault was fine. The guard was honest. The door mechanism worked correctly,” Dolev said. “The lie was whispered directly to the one party whose word opened the door.”

    But while LayerZero, whose infrastructure powered the drained bridge, pointed to Lazarus as the likely culprit, Cyvers stopped short of the same attribution in its own analysis.

    Some patterns match DPRK-linked operations in sophistication, scale, and coordinated execution, Dolev said, but no wallet clustering tied to the group has been confirmed.

    The malicious node software was engineered to erase itself once the attack finished, wiping binaries and logs to obscure the attackers’ trail in real time and in the post-mortem, he added.

    Earlier this month, attackers drained roughly $285 million from Solana-based perpetuals protocol Drift, in an exploit later attributed to North Korean operatives.

    Dolev noted that the Drift hack was “very different in terms of the preparations and execution,” but both attacks required long lead times, deep expertise, and significant resources to pull off.

    Cyvers suspects that the stolen funds have been transferred to this Ethereum address, aligning with a separate report from on-chain investigator ZachXBT which flagged it alongside four others. The attack addresses were funded through coin mixer Tornado Cash, per ZachXBT.

    Daily Debrief Newsletter

    Start every day with the top news stories right now, plus original features, a podcast, videos and more.

  • Morning Minute: DeFi’s Future in Question After $292M KelpDAO Exploit

    Morning Minute: DeFi’s Future in Question After $292M KelpDAO Exploit

    3,478.5543
    Morning Minute is a daily newsletter written by Tyler Warner. The analysis and opinions expressed are his own and do not necessarily reflect those of Decrypt. And check out our new daily news show covering all of the top stories in 5 minutes or less, downloadable on Apple Pod or Spotify.

    GM!

    Today’s top news:

    • Crypto majors fall then rebound as Iran tensions escalate; BTC at $75.4k
    • ETFs see $1.4B in inflows on the week, 2nd biggest week of year
    • DeFi TVL falls by $13B as KelpDAO exploit fallout worsens; AAVE -25%
    • Vercel CEO says “highly sophisticated” actors used AI for its exploit
    • Asteroid meme holds at $150M market cap after Elon says “ok” for SpaceX mascot

    🔴 $292M Kelp DAO Exploit Triggers Aave Bank Run, $9B Leaves DeFi in a Day

    Saturday at 17:35 UTC, an attacker sent a single crafted message to Kelp DAO’s LayerZero-powered cross-chain bridge.

    The bridge accepted it as legitimate and released 116,500 rsETH – roughly $292 million and 18% of total circulating supply—to a wallet that had been pre-funded through Tornado Cash ten hours earlier. No ETH ever changed hands on the other side. The rsETH was effectively minted from nothing. The attacker deposited it into Aave V3 and V4 as collateral, borrowed real wrapped ETH against it, and walked.

    Aave didn’t get hacked. Its contracts are fine. But it’s now carrying roughly $196M in bad debt it didn’t create, because rsETH had been whitelisted as ETH-correlated collateral—a faulty assumption.

    In the aftermath, TVL on AAVE dropped 25% from $26.4B to ~$20B in a single day and continues to fall by the day. Broader DeFi TVL fell by $13B. The AAVE token fell 30%.

    ETH depositors trying to withdraw found liquidity at zero, so they started borrowing stablecoins against their deposits to exit—a textbook bank run. SparkLend, Fluid, Upshift, and Lido all froze or paused rsETH exposure. rsETH holders on 20+ chains now have tokens of uncertain backing.

    Aave’s own statement Sunday said rsETH on Ethereum mainnet is “fully backed” but remains frozen “out of an abundance of caution.” But the damage has been done.

    DeFi users are re-evaluating the calculus. Does it make sense to risk exploits for average yield? And now every lending protocol has to reassess security. It will take time to rebuild from this, if it’s even possible.

    There have been $600M lost from DeFi via exploits in just the past 3 weeks. And the pace is accelerating…

    Key Details:

    • Kelp DAO’s LayerZero bridge was exploited Saturday for 116,500 rsETH (~$292M, 18% of supply); attacker minted unbacked rsETH and used it as Aave collateral to borrow real WETH; ~$196M in bad debt left on Aave; AAVE -30%; largest DeFi exploit of 2026
    • The contagion: Aave froze rsETH and WETH across Ethereum, Arbitrum, Base, Mantle, and Linea; TVL dropped $6.2B in one day; ETH depositors borrowing stablecoins to exit triggered a bank run dynamic; SparkLend, Fluid, Upshift, and Lido all froze rsETH exposure
    • The structural issue: LRT tokens like rsETH were whitelisted as near-ETH collateral on Aave, Compound, and Euler; this exploit assumes backing was intact at all times; it wasn’t; every DeFi lending protocol now needs to reassess liquid restaking token collateral risk

    🌊 BTC Hit $78K; Then Iran Closed Hormuz Again

    Friday was the most violent 24 hours in crypto markets since the war started.

    Iranian FM Araghchi posted that the Strait of Hormuz was “fully open to all commercial vessels.” Trump followed on Truth Social claiming Iran agreed to an “unlimited” suspension of its nuclear program and said a permanent deal was “mostly complete.”

    Bitcoin ran from $74.5K to $78,400 – its first print above $78K since February 4. Oil crashed nearly 10% to ~$82/barrel. The S&P 500 closed at a record 7,121. There were $600M+ in crypto short liquidations. The ETFs posted ~$800M+ in inflows, the biggest in months.

    The vibes were euphoric.

    By Saturday morning, tanker owners were receiving Iranian radio transmissions closing the strait. State media said Hormuz had returned to “strict management and control.” BTC pulled back to ~$74K giving back its recent gains, Oil rebounded to $90 and stock futures are red.

    And a return to war looks more likely than ever…

    📅 Saylor Wants to Pay STRC Dividends Twice a Month

    Strategy filed a preliminary proxy Thursday proposing to shift STRC dividend payments from monthly to semi-monthly.

    The annual rate stays at 11.5%, and the $1.2B total obligation is unchanged. Holders would just receive smaller checks every two weeks instead of one larger check per month. If approved, the first semi-monthly payment lands July 15.

    The reason this matters can be seen in the STRC price action over the past few months. Leading up to the dividend cut off date of the 15th, STRC trades at or above its $100 par with increasing volume until the 14th. Then it goes sub-par for a few weeks as traders no longer need to hold for the dividend. Around the 1st of the month, it hits $100 par again and the cycle repeats.

    Well with semi-monthly dividend payments, Saylor could potentially erase that 2-week period where STRC trades sub-par. That would mean more potential capital for him to use to buy Bitcoin – and a safer hold for those holding STRC.

    Assuming this goes through, expect Bitcoin to benefit (and maybe even bigly)…

    🚀 A Dying Girl’s Wish Made a Meme Coin Worth $175M

    Liv Perrotto was 15 years old when she died of cancer in January. Before she passed, she had designed a plush Shiba Inu named Asteroid that flew aboard SpaceX’s Polaris Dawn mission in 2024 as the zero-gravity indicator. Her dying wish was simple: she wanted Elon Musk to make Asteroid the official SpaceX mascot.

    Radio host Glenn Beck posted her story on X Thursday night. Elon replied “Will answer shortly” at 11:50 PM ET. That response alone was enough to send the ASTEROID meme coin to a $30M+ market cap.

    But traders anxiously awaited Elon’s response. On April 18 in the afternoon, they got it. Elon answered the girl’s questions for him and replied “OK” to the SpaceX final item, confirming Asteroid as the official SpaceX mascot.

    The token immediately sent to $100M+ in market cap within hours, reaching $190M+ overnight. It’s now trading near $155M.

    Now the question becomes—will Elon continue leaning in and actually make Asteroid Shiba the SpaceX mascot? Or was this a one off response?

    🌎 Macro Crypto and Markets

    • Crypto majors are red but rebounding after a big Sunday selloff; BTC -0.1% at $75.4k; ETH -1% at $2,316; SOL flat at $85; HYPE -4% at $41.30
    • SKY (+5%), CC (+4%) and M (+7%) led top movers
    • Oil +2% at $88; Gold even at $4,780
    • Stock futures red after record-breaking green streak
    • Vercel’s CEO confirmed a breach traced to a compromised third-party AI tool (Context.ai), which gave attackers access to internal Vercel environments via a hijacked Google Workspace account; CEO Guillermo Rauch called the actors “highly sophisticated” and said they may have used AI to accelerate the intrusion
    • Coinbase is deploying AI agents modeled after legendary former executives directly into Slack and email; “Fred” is based on co-founder Fred Ehrsam and acts as a strategic planning agent; “Balaji” is modeled after former CTO Balaji Srinivasan and is designed to challenge assumptions and spark innovation
    • Sam Altman’s World launched its biggest upgrade yet, bringing iris-scan proof-of-human verification to Zoom, Tinder, and concert ticket sales; Tinder will show a “verified human” badge, Zoom gets a deepfake-detection feature called Deep Face, and Concert Kit lets artists reserve tickets for real humans to block scalper bots

    Corporate Treasuries & ETFs

    Meme Coin Tracker

    • Meme leaders were green on the day and week; DOGE +1%, SHIB +31%, PEPE +1%, TRUMP +1%, PENGU +2%, SPX -1%, FARTCOIN -2%
    • Asteroid (+150x), Belief (+400%), Zerebro (+40%), and Griffain (+39%) led notable onchain movers

    💰 Token, Airdrop & Protocol Tracker

    • Creator Fun launched this wekend with a trading terminal, launchpad, AMM and more calling itself “The iPhone moment for Solana”; its CRX token at $13M
    • The RAVE token fell 90% after a ZachXBT investigation

    🚚 What is happening in NFTs?

    • NFT leaders rallied over the weekend but fell overnight; Punks -1% at 26.6 ETH, Pudgy -5% at 4.36 ETH, BAYC -6% at 7.85 ETH; Hypurr’s -1% at 386 HYPE
    • Normies (+20%) and Nakamigos (+15%) led notable movers
    • A PUNK token was airdropped to all Punk holders, soaring 200,000% to $10M in its first night of trading

    Daily Debrief Newsletter

    Start every day with the top news stories right now, plus original features, a podcast, videos and more.

  • JUST IN: U.S. President Donald Trump Makes a Statement on the Iran Ceasefire – “The Likelihood of an Extension Is Very Low”

    JUST IN: U.S. President Donald Trump Makes a Statement on the Iran Ceasefire – “The Likelihood of an Extension Is Very Low”

    US President Donald Trump, in a statement regarding the extension of the ceasefire agreement with Iran, said that under the current circumstances, extending the agreement is “quite unlikely.”

    Speaking ahead of the ceasefire, which is set to end Wednesday evening Washington time, Trump stated that conflict could be inevitable if an agreement could not be reached between the parties.

    Trump announced that US Vice President JD Vance would be traveling to Pakistan today and that negotiations would proceed within that framework. He maintained that the Strait of Hormuz would only be reopened after a formal agreement was signed, and stated that the talks with Iran were beneficial to all parties. The US President also indicated that he might want to participate in the talks personally, but did not think it was necessary.

    Related News Trading Volume Surges for 15 Altcoins in South Korea – XRP Tops the List

    Markets fluctuated following Trump’s remarks. The S&P 500 index extended its losses to 0.5%, while oil prices briefly rose by $1.

    On the other hand, statements from the Iranian side increased the uncertainty surrounding the negotiation process. Tasnim News Agency, known for its close ties to Iran, reported on April 20 that the Tehran administration’s decision not to participate in the talks remained unchanged. This indicated that diplomatic contacts between the parties had not yet made any concrete progress.

    Assessments on the issue also came from Europe. French President Emmanuel Macron criticized both the US and Iran for their stances on closing the Strait of Hormuz, arguing that both sides were taking the wrong approach.

    In addition, according to information reported by Axios, the US is preparing to host a new round of talks between Israel and Lebanon on April 23.

    *This is not investment advice.

  • Crypto Asset Company Bitmine Makes Largest Ethereum (ETH) Purchase in Four Months! Here Are the Details

    Crypto Asset Company Bitmine Makes Largest Ethereum (ETH) Purchase in Four Months! Here Are the Details

    Bitmine, a crypto asset-focused investment company, attracted attention with its large-scale purchases in the past week.

    The company achieved its fastest accumulation pace in the last four months, purchasing 101,627 Ethereum ($ETH) in just one week. This increase stands out as the largest weekly expansion recorded since the high-volume purchases last seen in the week of December 15, 2025.

    Bitmine’s total $ETH holdings have increased to 4,976,485. This amount represents approximately 4.12% of Ethereum’s total supply. Controlling an asset of this scale makes the company one of the leading players among institutional investors.

    Bitmine’s overall financial strength has also reached remarkable levels. The total value of the company’s crypto assets, cash reserves, and other investments is estimated at approximately $12.9 billion. This portfolio includes $1.12 billion in cash assets, 199 Bitcoin (BTC), a $200 million stake in Beast Industries, and approximately $107 million in investments in Eightco Holdings.

    Experts say Bitmine’s aggressive Ethereum accumulation strategy demonstrates the company’s strong long-term value expectation for $ETH. The increasing interest from institutional investors points to continued confidence in the future of the Ethereum ecosystem.

    *This is not investment advice.

  • Kelp DAO Exploit Sparks Aave Liquidity Crunch, $6.2 Billion Withdrawal Panic

    Kelp DAO Exploit Sparks Aave Liquidity Crunch, $6.2 Billion Withdrawal Panic

    In brief

    • Aave users struggled to withdraw funds from Aave after attackers borrowed with stolen rsETH on the platform, spiking a core market’s so-called utilization rate.
    • The funds were plundered from a LayerZero-powered bridge, in what onlookers described as DeFi’s biggest exploit so far this year.
    • Early Sunday, DefiLlama’s 0xngmi said Aave had faced $6.2 billion in net withdrawals, while Spark’s monetsupply.eth pointed to “negative secondary effects.”

    Less than a day after attackers drained $291 million in crypto from infrastructure linked to decentralized finance project Kelp DAO, users on Aave, one of DeFi’s most battle-tested protocols, struggled to withdraw funds amid a liquidity crunch.

    A bridge that typically allows users to move an asset called rsETH from one network to another was exploited on Saturday, prompting Aave to freeze markets tied to the token, which attackers had used to borrow funds from the platform, the lending protocol said in an X post.

    Meanwhile, Kelp DAO said in an X post that it had “paused rsETH contracts” across Ethereum’s mainnet and several layer-2 scaling networks as it investigates suspicious activity.

    The attackers’ activity on Aave caused the so-called utilization rate of a core lending pool to spike to 100%, signaling that users who previously deposited Ethereum and wrapped Ethereum have been left with little to no liquidity to withdraw, Aavescan data showed.

    An hour before Aave locked down the markets, blockchain security firm PeckShield flagged a transaction showing 116,500 rsETH, worth $291 million at the time, flowing to a fresh wallet.

    The attackers didn’t abscond with rsETH that had been maliciously released from the bridge. Rather, they used Aave to borrow regular funds, creating “massive bad debt,” Francesco Andreoli, head of developer relations at Consensys and MetaMask, said in an X post. (Disclaimer: Consensys is one of many investors in an editorially independent Decrypt.)

    Aave’s governance token plunged to $90.13 on Sunday, a 16% decrease over the past day, according to CoinGecko. Ethereum fell 2% to $2,300 over the same period.

    As users struggled to withdraw from Aave, they began borrowing against their deposits in stablecoins, straining the liquidity further as a sign of “negative secondary effects,” said monetsupply.eth, the pseudonymous head of strategy at DeFi project Spark, in an X post.

    The Kelp DAO exploit and ensuing fallout on Aave prompted a massive wave of withdrawals from several DeFi protocols, even those that were unaffected, according to 0xngmi, the pseudonymous co-founder of data provider DefiLlama. On a net basis, users had yanked $6.2 billion from Aave alone by early Sunday, they said in an X post.

    With contagion appearing to spread, DeFi’s latest exploit provides “a lot of ammo” for critics skeptical of systems that seek to replace traditional financial intermediaries with code, Salman Banei, general counsel at Plume, a network focused on tokenization, said in an X post.

    Kelp DAO issues rsETH, a liquid staking token that allows users to earn Ethereum staking and EigenLayer restaking rewards. It acts as a tradeable “receipt” for Kelp DAO depositors. The Kelp DAO bridge was built on top of infrastructure designed by LayerZero, a protocol that allows DeFi applications to send messages and transfer assets across blockchains.

    Stacy Muur, a noted blockchain researcher, said in an X post that the exploit appeared to rely on a single point of failure. She wrote that a “phantom” message used by attackers essentially tricked Kelp DAO’s bridge into releasing rsETH on Ethereum without removing a corresponding amount of tokens from circulation on Ethereum layer-2 Unichain.

    Nonetheless, some onlookers were eager to find a path forward, including crypto entrepreneur and Tron founder Justin Sun. He attempted to negotiate, arguing that the attackers would ultimately struggle to spend the stolen funds.

    “How much [do] you want?” he asked them in an X post. “It’s simply not worth it to sacrifice both Aave and Kelp DAO and let them go down over this hack.”

    Daily Debrief Newsletter

    Start every day with the top news stories right now, plus original features, a podcast, videos and more.

  • Blockchain sleuth accuses RaveDAO of knowing who manipulated the price of its token

    Blockchain sleuth accuses RaveDAO of knowing who manipulated the price of its token

    Blockchain sleuth ZachXBT wrote on Sunday that the team behind RaveDAO is at least aware of who manipulated the price of its token, which saw an impossible 11,000% surge in price followed by a near immediate collapse.

    “I found suspicious CEX (centralized crypto exchanges) activity on April 26 tied to RaveDAO team addresses onchain, which potentially contradicts their recent statements,” the blockchain investigator said.

    In a separate post, ZachXBT flagged a transfer from a $RAVE address used for “initial distribution” by RaveDAO from which roughly $23 million worth of tokens were transferred to two Bitget deposit addresses causing the price to drop 40% from $1 to $0.6.

    RaveDAO posted a six-part X thread on Saturday, previously reported by CoinDesk, stating “we are aware of the rumors and accusations circulating regarding $RAVE and the RaveDAO team. We want to be clear: RaveDAO team is not engaged in, nor responsible for, recent price action.”

    However, ZachXBT said, “given the supply concentration, the team at minimum knows who is responsible for this price action.”

    In a separate X post, the investigator said, “you expect the community to believe $RAVE went $60M -> $6B mkt cap organically in nine days with little to no utility? Considering your team handled the initial distribution with a low float it’s unlikely you do not know the party responsible for it.”

    The RaveDAO token, which increased by nearly 11,000% in nine days from about $0.25 to $27.33, then plunged by over 90%, losing roughly $5.7 billion in market capitalization in just 48 hours. Its price currently hovers around $0.67.

    The sleuth also said $RAVE is not the only token with manipulation “we have seen on major centralized exchanges. It’s just the most blatant.” He also said it was highly unlikely the CEXs did not spot the massive $RAVE token price movements.

  • UK gas-investment firm weighs bitcoin mining, draws criticism

    UK gas-investment firm weighs bitcoin mining, draws criticism

    Reabold Resources, an investment company focused on developing European gas projects, said it is considering establishing a gas-powered bitcoin mining station in northern England.

    The London-based company is exploring the potential to deploy a small power plant as a pilot for future target=”_blank”>it said in a statement on Monday.

    Bitcoin production from the company’s West Newton A well site will be used to demonstrate the ability to use the gas to fuel target=”_blank”>Telegraph article criticizing the plan at a time when the country could face gas shortages because of the war between Iran and the U.S. and Israel.

    Concerns of potential gas shortage are unfounded according to a U.K. government statement in late March, which said gas supply will not be affected.

    “Only about 1% of the U.K.’s gas supply in 2025 came from Qatar. We have no reason to expect it would be significantly different in 2026,” it said.

    The Telegraph’s article said Reabold’s West Newton gas field is so large it could theoretically power the creation of 50,000 bitcoin tokens.

    “A private gas supply means we can run a data centre to mine bitcoin relatively cheaply,” said Sachin Oza, the co-CEO of Reabold Resources, which has a drilling license by the Environment Agency.

    “Initially, this would help fund the further development of the gas field and prove the concept – meaning it could become the precursor to a far larger data center.”

    But, the firm said, “the significant onshore natural gas resource at the West Newton site in Yorkshire has and will continue to be progressed for the benefit of U.K. energy security, which is particularly important at this time of significant geopolitical uncertainty.”

    Reabold’s plan for a bitcoin mining operation to broaden into a data center comes bitcoin mining is undergoing a transformation, with many companies diverting into high-performance computing and support for the AI industry.