DAO Maker (DAO) Plunge

A sophisticated crypto laundering operation was executed following the $292 million hack of Kelp DAO on April 18. The attack, attributed to the North Korean Lazarus group, began with anonymous infrastructure preparation using Tornado Cash to fund wallets untraceably. The hacker exploited a vulnerability in Kelp’s cross-chain bridge, stealing 116,500 rsETH. To avoid crashing the market, the attacker used Aave and Compound as laundering tools—depositing the stolen rsETH as collateral to borrow $190 million in clean, liquid ETH. This move triggered a bank run on Aave, causing an $8 billion drop in TVL. After consolidating funds, the attacker fragmented them across hundreds of wallets to evade detection. A major breakpoint was THORChain, where over $460 million in volume—30 times its usual activity—was processed in 24 hours, converting ETH into Bitcoin. This shift to Bitcoin’s UTXO model exponentially increased tracing complexity by shattering funds into countless untraceable fragments. The final destination was Tron-based USDT, the primary channel for illicit crypto flows. From there, funds were cashed out via OTC brokers in China and Southeast Asia, using unlicensed underground banks and UnionPay networks outside Western sanctions scope. Ultimately, the laundered money supports North Korea’s weapons programs, which rely heavily on crypto hacking for foreign currency. The incident underscores structural challenges in DeFi: its openness, composability, and lack of central control make such laundering not just possible, but inherently difficult to prevent.

A group of activist investors, often labeled as "treasury raiders," have submitted proposal GIP-150 to Gnosis DAO, calling for a one-time, voluntary, and proportional treasury redemption. The proposal would allow participating GNO holders to claim a share of the over $220 million in DAO reserves. Proponents argue this addresses the persistent and widening discount of GNO's market price relative to the treasury's net asset value. Despite recent DAO funding to Gnosis Ltd., the discount has increased. The current vote, closing May 12th, shows 65% opposition among early votes. The redemption would value each eligible token around $170, a ~30% premium to the current $131 market price. GNO held by Gnosis Ltd. is excluded. DeFi community reactions are mixed. Some commentators acknowledge the "risk-free value" (RFV) arbitrage logic but criticize the proposal as a short-term cash grab lacking legitimacy, as Gnosis never promised treasury backing for the token price. Others oppose it due to Gnosis's contributions to ecosystem infrastructure (Safe, CoW Swap, etc.). Founder Sebastian Bürgel lamented the targeting of respected builders. Aragon's team, previously targeted in similar RFV campaigns, called for better mechanisms to align incentives. This follows a pattern of 2023 RFV-style actions against projects like Rook and Aragon. Recently, Beefy Finance implemented a buyback to preempt such pressure. The proposal's author, Wismerhill, expressed past admiration for Gnosis but now sees this vote as a test of whether holders prioritize short-term arbitrage or long-term ecosystem value.

On May 26th, Kelp DAO successfully transferred its final batch of rsETH, completing the 37-day process of fully backing rsETH 1:1 after a security incident. However, the resolution came at a significant cost to Aave. The protocol's TVL plummeted by over $12 billion in the following month. Furthermore, a separate legal battle over 30,766 frozen ETH continues in court, posing ongoing reputational risk. The recovery was enabled by an unprecedented, one-time coalition dubbed "DeFi United," involving major contributions from Aave's founder, treasury, Consensys, Mantle, and others. Despite this, the event triggered a major outflow of funds, with whales like Justin Sun moving capital to competitors like Spark. Aave's path to regaining its position relies heavily on the successful execution of its multi-pronged strategy. Its new V4 protocol, designed for open, heterogeneous asset markets, faces delays due to internal governance disputes. Meanwhile, the V3 version remains the core revenue generator, and the permissioned Horizon fork is targeting institutional RWA (Real-World Assets) growth—a segment less impacted by the rsETH incident but dependent on traditional finance adoption timelines. The key takeaway is that while the immediate bad debt was covered, Aave paid a steep price in lost trust and capital. Recovering market share depends on accelerating V4's rollout and advancing its institutional RWA offerings, both of which face external and internal hurdles. The "DeFi United" safety net is unlikely to be replicable for future crises.

Title: Kelp DAO Exploit Triggers $15 Billion Exodus, Exposing a Clash Between Two DeFi Lending Models. In April 2026, a hacker exploited a LayerZero bridge vulnerability in the Kelp DAO project, minting $292 million in fake rsETH tokens. These were deposited into Aave as collateral to borrow real Ethereum, draining the protocol's liquidity. Within three and a half days, Aave saw $15 billion in deposits flee, forcing a costly $160 million bailout. The root cause was identified as Aave's governance, which had previously voted to set rsETH's loan-to-value ratio to a risky 93%, leaving minimal safety margin. This incident starkly contrasts with the experience of Morpho, the second-largest DeFi lending protocol. Some fake rsETH also flowed into Morpho, but the exposure was limited to $1 million across isolated, pre-configured markets, preventing systemic contagion. The event highlights a fundamental divergence in DeFi lending architectures. Aave employs a shared liquidity pool model, where all deposits back all approved collateral assets, governed by DAO vote. This creates systemic risk, as seen when even users who never interacted with rsETH faced frozen funds. Furthermore, Aave's governance, influenced by leveraged borrowers, prioritized their interests during the crisis, even lowering borrowing rates for frozen markets at the expense of safer depositors. Its supplemental insurance mechanism, Umbrella, also failed as providers withdrew capital when needed. Morpho operates on an isolated market model. Anyone can create a separate lending market with fixed parameters (collateral, loan asset, oracle, rates). Independent risk managers (curators) allocate capital to these markets, bearing losses within their own vaults if they occur. This structure prevents risk from spreading and removes governance conflicts, as curators' decisions are not subject to community override. Beyond crisis management, the shared pool model carries a hidden cost: idle capital. In Aave's core markets, the spread between borrowing and deposit rates represents unusable funds, costing an estimated $52 million annually in lost value. Morpho's model targets a higher utilization rate (90% vs. Aave's 60-80%) because it eliminates rehypothecation risk, dynamically adjusting rates to balance supply and demand without governance delays. Consequently, Morpho often offers higher net yields to depositors. Institutional adoption underscores this difference. Major players like Coinbase (powering its lending for over 100M users), Apollo Global Management, Anchorage Digital, and SG-FORGE (Societe Generale) have chosen to build on Morpho. They require compliant, self-controlled risk parameters that Aave's community-governed model cannot provide. This trend is amplified by regulations like the proposed US GENIUS Act, which will push stablecoin issuers to seek neutral, controllable infrastructure like Morpho to manage trillions in reserve assets.