CryptoSlate
Active use of tokenized real-world assets in DeFi has recovered to roughly $3.77 billion as of July 22, according to DefiLlama tracking, about 95 days after the April 18 KelpDAO exploit drained an estimated $13 billion from DeFi TVL in 48 hours. The incident began with a compromised LayerZero verification setup that let an attacker forge a cross-chain message and mint around 116,500 unbacked rsETH, worth about $292 million. Aave accepted the token as collateral, the attacker borrowed against it, and the resulting run pulled $8.45 billion out of Aave within two days, spreading into lending markets with little or no direct rsETH exposure.
Why it matters
The recovery is fast but uneven. Ethereum still anchors the active market with about $1.98 billion, or 53% of the total, spread across syrupUSDC ($415M), syrupUSDT ($323M), gold-backed XAUT ($235M), reUSD ($157M), PRIME ($155M), JAAA ($152M), and USTB ($134M). Outside Ethereum, roughly 47% of active value sits on chains like Solana ($464M, the largest varied non-Ethereum market), Monad ($337M, a new deployment center), Avalanche ($261M, almost entirely JAAA via Grove), and Plasma ($211M, $206M of which is Maple's syrupUSDT). Private credit dominates: Maple's two credit tokens alone hold about $1.3 billion across every chain that lists them, with JAAA adding another $412M in CLO exposure.
Market impact
LayerZero has since said its verification network will no longer act as the sole required attestor on any channel, and Aave coordinated with partners to restore rsETH backing and absorb the bad debt. The gap that let one compromised bridge drain markets with no direct exposure is closed on paper, but whether the recovered $3.77 billion of bridges, wrappers, and collateral lists price cross-chain risk with the same rigor stays unresolved. The composition of that rebound, how diversified, how liquid, and how carefully underwritten, will decide whether the resilience holds when the next bridge or collateral listing fails.
Frequently asked questions
-
How fast did active RWA use in DeFi recover after the KelpDAO exploit?
DefiLlama tracking shows active RWA value rebounded to roughly $3.77B as of July 22, about 95 days after the April 18 exploit triggered an estimated $13B drop in DeFi TVL within 48 hours.
-
What happened during the KelpDAO exploit on April 18?
A compromised LayerZero verification setup let the attacker forge a cross-chain message and mint about 116,500 unbacked rsETH, worth roughly $292M. Aave accepted it as collateral, the attacker borrowed against it, and $8.45B exited Aave within two days.
-
Which chains hold the largest share of recovered active RWA value?
Ethereum leads with about $1.98B, or 53% of the active total. Solana holds ~$464M, Monad ~$337M, Avalanche ~$261M, and Plasma ~$211M, with private credit tokens doing most of the work outside Ethereum.
-
What has LayerZero changed since the April incident?
LayerZero said its verification network will no longer act as the sole required attestor on any channel, closing the specific gap the April exploit exposed. Aave coordinated with partners to restore rsETH backing and absorb the bad debt.
-
Why does the recovery still look fragile?
Private credit tokens, especially Maple's syrupUSDC and syrupUSDT, hold roughly $1.3B of the $3.77B active total, and a few chains depend almost entirely on a single asset. Thin depth and concentrated collateral lists mean a similar bridge or onboarding failure could still force supply-cap cuts and liquidity exits.
CoinDesk
TheBlock
CoinTelegraph
Crypto News
WuBlockchain