Two days. Thirteen billion dollars. One broken bridge.

That is the story of DeFi's worst week so far in 2026, and it is worth reading slowly — because the mechanism that caused the damage is not some exotic edge case. It is baked into how decentralized finance currently works.

On April 20, Aave — one of the most battle-tested lending protocols in the space — watched $8.45 billion in deposits walk out the door in 48 hours. That single number accounts for most of the $13.21 billion drop in total value locked (TVL) across DeFi platforms. The trigger was a $292 million exploit of Kelp's bridge that left the protocol's rsETH token unbacked. What followed was a controlled demolition of confidence across the entire interconnected lending stack.

What Actually Happened

Kelp is a liquid restaking protocol that issues rsETH — a token representing staked Ethereum positions. Users deposit ETH, receive rsETH, and can then deploy that token elsewhere in DeFi as collateral to borrow against.

Attackers exploited a vulnerability in Kelp's bridge, draining $292 million and leaving the rsETH in circulation without the ETH backing it. In other words: the collateral was suddenly counterfeit.

That should have been Kelp's problem alone. Instead, it became everyone's problem.

Because rsETH had been accepted as collateral across lending protocols — most prominently Aave — users who had borrowed against it were now sitting on positions backed by an asset of uncertain value. Anyone paying attention had one rational move: get out before the bad collateral crashed rsETH's price and triggered a cascade of liquidations.

So they got out. Fast. $8.45 billion fled Aave in 48 hours.

This is not a bug in Aave's code. It is a feature of how DeFi composability works — and why composability, DeFi's most celebrated property, is also its most dangerous one.

The Composability Problem Nobody Wants to Advertise

DeFi works by letting protocols stack on top of each other. Deposit ETH into a staking protocol, get a liquid token. Deposit that token into a lending protocol, get a loan. Deposit that loan into a yield farm. Each step adds capital efficiency. Each step also adds a link in a chain that, if broken at any point, can unwind the entire structure.

This is not a new concept. Analysts and developers have warned about it for years. But warnings are easy to dismiss when the stack is working smoothly and yields are attractive. It takes a $292 million bridge exploit to make the lesson visceral.

The specific attack vector here — minting unbacked tokens and using them as collateral in lending markets — is also not novel. Variations of this attack have appeared before. That it worked again at this scale suggests either the detection mechanisms were insufficient, the collateral risk parameters were too loose, or both.

LayerZero pointed to a single-point setup as a contributing factor in the Kelp bridge failure, according to a separate report from The Block. That detail matters. Single points of failure in bridge architecture are a known vulnerability class. Bridges that move value between chains or between protocol layers are consistently among the highest-risk components in any DeFi stack.

Wider Market Context: Crypto Held Relatively Steady

Remarkably, broader crypto markets absorbed most of this without catastrophic price action. Bitcoin was trading around $74,000 to $75,000 on the day, down modestly alongside general risk-off sentiment tied to fresh U.S.-Iran tensions and new controls on the Strait of Hormuz. Ethereum was in the $2,275 to $2,300 range. Solana hovered near $84.

The declines were real but measured — under 1.5% for most major assets. Oil and traditional equities repriced more sharply on the geopolitical news than crypto did, which is a noteworthy divergence. It suggests markets are beginning to treat crypto as something distinct from pure risk-on speculation — at least in some scenarios.

Spot Bitcoin ETFs reinforced that reading. The week saw nearly $1 billion in ETF inflows, the highest weekly figure since mid-January, according to both CoinTelegraph and The Block. Institutional flows into regulated Bitcoin vehicles held up even as DeFi was being drained. That split — ETF inflows steady, DeFi TVL collapsing — illustrates how differently the two ends of the crypto market are being used right now.

A Second Front: Vercel Gets Hacked

While DeFi was absorbing the rsETH fallout, crypto developers faced a separate fire drill. Vercel — a widely used deployment platform among crypto application builders — disclosed a breach that potentially exposed API keys and credentials stored on the platform.

For end users, this may sound like a backend problem. It is not. API keys stored on deployment platforms can give attackers access to smart contract interactions, backend wallet management systems, oracle feeds, and any off-chain service that a crypto application relies on. Compromised keys are not a theoretical risk — they are a direct path to drained funds.

Developers building on Vercel were advised to rotate API keys immediately. If you use any DeFi application or crypto service that was recently acting strangely, a compromised backend credential is now a legitimate item on the diagnostic list.

Two separate security incidents in the same 48-hour window — one at the protocol layer, one at the infrastructure layer — is not a coincidence to file away. It is a reminder that the attack surface in crypto runs from smart contract logic all the way down to the platforms developers use to ship code.

What to Watch Next

A few threads worth tracking in the coming days and weeks:

Aave's response. How the protocol adjusts collateral parameters for liquid restaking tokens will set a precedent for the industry. Expect governance discussions around tighter risk parameters for any collateral that involves a bridge or cross-protocol dependency.

rsETH recovery and Kelp's path forward. Whether Kelp can cover the shortfall — through reserves, insurance funds, or community action — will determine how much permanent damage was done to rsETH holders. The answer will also influence how the market prices bridge risk going forward.

Bridge architecture scrutiny. LayerZero's statement flagging a single-point setup as a contributing factor will put pressure on other bridge protocols to audit their own designs. Multi-sig thresholds, decentralized validator sets, and circuit breakers are all back on the discussion agenda.

The ETF inflow story. The $1 billion weekly inflow figure deserves continued monitoring. If institutional money keeps flowing into Bitcoin ETFs while DeFi TVL struggles to recover, it will accelerate an already visible bifurcation in the market — regulated, custodied exposure on one side; permissionless, composable protocols on the other.

The Kelp exploit did not kill DeFi. But $13 billion in TVL exits in 48 hours is not noise. It is the market telling you, clearly, that composability without adequate risk isolation is a structural liability — and that anyone building or investing in interconnected DeFi protocols needs to understand that liability before the next bridge fails.