DeFi RWAs Recover from KelpDAO Exploit, But Composability Risks Remain

DeFi's tokenized real-world assets (RWA) have made a remarkable recovery from the April KelpDAO exploit that saw a $13 billion decline in 48 hours. The active use of RWA in DeFi has returned to about $3.77 billion, just shy of pre-exploit levels, according to DefiLlama's tracking. This recovery took roughly 95 days and is attributed to the resilience of the DeFi ecosystem.

The KelpDAO exploit occurred on April 18 when attackers compromised a verification setup, allowing them to forge a cross-chain message and release $292 million worth of unbacked rsETH through LayerZero's multichain infrastructure. The resulting run pulled $8.45 billion out of Aave within two days, spreading to lending markets with little or no exposure to rsETH.

Despite the significant loss, DeFi protocols have since taken steps to restore rsETH backing and cover the resulting bad debt. LayerZero has also changed its verification network to require multiple attestors, reducing the risk of similar attacks in the future.