Ethereum stablecoins, tokenized funds fall 19% after KelpDAO exploit

Ethereum’s stablecoin and tokenized-fund market capitalization fell 19% to approximately $168 billion from $206.7 billion between April and early November 2026, according to reporting by Dado Ruvic.

On November 9, 2026, KelpDAO parent Evercrest Technologies sued LayerZero Labs and its chief executive over an April 18 exploit that Ruvic reported drained roughly $292 million, or 116,500 rsETH, from KelpDAO.

What did the KelpDAO exploit do?

Attackers entered through KelpDAO’s bridge infrastructure and compromised a single LayerZero decentralized verifier node, or DVN. The loss occurred over 46 minutes on April 18, 2026.

Once attackers controlled the node, they could manipulate messages passing through that notary. They used that access to mint tokens with nothing backing them, turning a verification failure into unbacked token issuance.

How did the loss reach lending markets?

Aave and other major lending protocols faced immediate liquidity problems as users rushed to withdraw funds. The withdrawals showed how stablecoins and tokenized funds function as DeFi’s cash layer: when that layer contracts, protocols have less capital to deploy.

Industry-wide total value locked, the assets investors parked in decentralized-finance protocols, fell by $8 billion to $14 billion immediately after the exploit. Ethereum’s stablecoin supply stood at approximately $135 billion on November 9, 2026.

Tokenized funds made up the rest of the roughly $168 billion combined market, which remained well below April’s $206.7 billion level. The smaller dollar base leaves protocols with less liquid capital for lending, borrowing and other on-chain financial activity.

In practical terms, DeFi has less dry powder to support credit markets and user withdrawals. That smaller pool can limit lending activity even if no additional protocol suffers an exploit. The contraction therefore reaches protocols that did not participate in the exploit.

What does Evercrest’s lawsuit change?

Evercrest’s complaint alleges negligence and failures around security and disclosure tied to the exploit. Ruvic’s report cautioned: “Those are allegations, and they have not been tested in court.”

LayerZero has linked the attack to North Korea’s Lazarus Group. The company says that group operated the exploit, but its attribution does not resolve Evercrest’s allegations or determine how liability should be allocated.

Operationally, the lawsuit places bridge verification and incident disclosure before a court. For bridge operators, the case could shape how security costs and liability are assigned after a cross-chain failure. For DeFi lenders, the immediate operational test is whether retained liquidity can cover withdrawals while the case proceeds.

What does the shrinking market mean for investors?

The episode also points to a change in capital allocation during 2026. Higher-risk yield products attracted substantial capital throughout the year, while the exploit pushed holders to reconsider those positions.

Ruvic summarized the market effect directly: “The capital that left has shown little urgency about coming back.” Ethereum’s roughly $135 billion stablecoin base now provides the clearest measure of whether that outflow continues.

The $292 million loss from one compromised verifier node was a public stress test for cross-chain bridges. The operational contrast is precise: one node’s failure preceded the liquidity run and an $8 billion-to-$14 billion fall in industry-wide TVL.

What should readers watch next?

The next checkpoints are whether Ethereum’s roughly $135 billion stablecoin supply stabilizes, how Aave manages liquidity and what discovery reveals in Evercrest’s case. The report specifies no court deadline or enforcement window, so supply data and the litigation record will determine whether DeFi’s smaller cash base becomes structural.