Drift

DeFi

XRP ETF

April

Aztec

<p>Binance Research said April’s DeFi exploits triggered about $13 billion in total value locked outflows, cutting liquidity across on-chain protocols.&nbsp;</p>
<div id="cn-block-summary-block_71a54725313e4a9a86008f40bc30fbef" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>April exploits compressed DeFi TVL, pushing leverage higher without clear evidence of stronger borrowing demand.</li>
   <li>Drift and KelpDAO attacks made April the worst recent month for DeFi security losses tracked.</li>
   <li>Recent Humanity, Aztec, and Raydium incidents show exploit risks remained active after April across DeFi.</li>
  </ul>
 </div>
</div>
<p>The research arm said the on-chain leverage ratio rose to about 38%, a level last seen in 2021, as TVL fell faster than borrowing.</p>
<p>The move did not come from a clear return in real borrowing demand. Binance Research said “meaningful deleveraging has yet to materialize,” even after a wider crypto market pullback. That means the ratio moved higher because the base of locked capital became smaller. When TVL falls, each dollar of debt weighs more on the system.</p>
<figure class="wp-block-embed is-type-rich is-provider-x wp-block-embed-x">
 <div class="wp-block-embed__wrapper">
  <blockquote class="twitter-tweet">
   <p>On-chain leverage ratio climbed to ~38%, matching 2021 levels, driven largely by TVL compression rather than renewed borrowing demand.<br><br>April's DeFi exploits triggered ~US$13B in TVL outflows. Despite the broader market pullback, meaningful deleveraging has yet to materialize. <a href="https://t.co/8KTBIUdRQ0" rel="noopener noreferrer nofollow">pic.twitter.com/8KTBIUdRQ0</a></p>— Binance Research (@BinanceResearch) <a href="https://x.com/BinanceResearch/status/2066672730335048094?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">June 16, 2026</a>
  </blockquote>
 </div>
</figure>
<p>You might also like: <a href="https://crypto.news/nvidia-taps-20b-debt-market-as-ai-boom-reshapes-bitcoin-mining/" rel="noopener noreferrer nofollow"> Nvidia taps $20B debt market as AI boom reshapes Bitcoin mining&nbsp; </a></p>
<h2 class="wp-block-heading" id="strong-drift-and-kelpdao-drive-april-losses-strong"><strong>Drift and KelpDAO drive April losses</strong></h2>
<p>Binance’s May market report <a href="https://www.binance.com/en/blog/research/6334904344641910107" rel="noopener noreferrer nofollow">said</a> DeFi TVL fell 10.7% month over month to $82.7 billion in April. It also said protocols suffered $635.24 million in exploits during the month, the highest monthly total since the Bybit incident in February 2025. DefiLlama counted 28 hack events during April, which Binance called a record monthly count.</p>
<p>As crypto.news <a href="https://crypto.news/april-2026-worst-month-for-crypto-hacks/" rel="noopener noreferrer nofollow">reported</a>, the first 18 days of April already saw more than $606 million stolen across 12 incidents. The two largest attacks were Drift Protocol, at about $285 million, and KelpDAO, at about $292 million. Later, crypto.news reported that the two attacks together <a href="https://crypto.news/north-korea-just-stole-577mn-from-crypto-with-two-attacks-heres-how/" rel="noopener noreferrer nofollow">represented</a> $577 million in losses and were linked to North Korea’s Lazarus Group.</p>
<p>Those two cases carried most of April’s reported losses. They also showed that DeFi exploit risk no longer comes only from code bugs. Reports tied the attacks to social engineering, compromised systems, governance weaknesses, and bridge infrastructure.</p>
<h2 class="wp-block-heading" id="strong-aave-and-kelpdao-recovery-stay-in-focus-strong"><strong>Aave and KelpDAO recovery stay in focus</strong></h2>
<p>The KelpDAO incident also spread pressure across connected lending markets. Binance Research said the KelpDAO exploit created about $230 million in bad debt on Aave and cut Aave’s TVL by half. The event showed how one bridge failure can move through DeFi when stolen collateral enters lending markets.</p>
<p>KelpDAO later completed the operational part of its rsETH recovery plan. As previously <a href="https://crypto.news/kelp-dao-reopens-full-rseth-functionality-after-cross-chain-exploit/" rel="noopener noreferrer nofollow">reported</a>, the protocol sent a final batch of 20,373.7 rsETH to the LayerZero smart contract used for cross-chain transfers. The protocol said minting, redemptions, and reward functions were operating normally again after earlier restart steps.</p>
<p>The recovery steps reduced some direct pressure on KelpDAO users. They did not remove the wider concern around DeFi leverage. Binance Research’s data suggests that the market still carries debt against a smaller pool of locked assets.</p>
<h2 class="wp-block-heading" id="strong-recent-exploits-show-risks-remain-active-strong"><strong>Recent exploits show risks remain active</strong></h2>
<p>Security incidents continued after April, though reported losses dropped in May. CertiK put <a href="https://crypto.news/crypto-hack-losses-drop-90-to-68-3m-in-may-certik-says/" rel="noopener noreferrer nofollow">May hack losses at $68.3 million</a>, down nearly 90% from April’s roughly $650 million, as reported. Still, DeFi projects kept facing attacks tied to bridges, old contracts, private keys, and operational controls.</p>
<p>Recent cases include Humanity Protocol, Aztec Connect, and Raydium. Humanity Protocol said more than <a href="https://crypto.news/humanity-protocol-says-compromised-admin-keys-led-to-36m-exploit/" rel="noopener noreferrer nofollow">$36 million was stolen</a> after attackers compromised administrative keys linked to its bridge systems. Aztec Connect <a href="https://crypto.news/aztec-connect-loses-2-1m-after-old-contract-exploit/" rel="noopener noreferrer nofollow">lost about $2.1 million</a> from an old immutable contract, while Raydium <a href="https://crypto.news/raydium-promises-full-refund-after-1-3m-solana-pool-exploit/" rel="noopener noreferrer nofollow">said</a> it would reimburse users after a $1.3 million exploit hit five legacy Solana liquidity pools.</p>
<p>The latest cases keep DeFi security in focus as leverage remains elevated and liquidity remains weaker than before April’s exploit wave. Binance Research’s reading points to a market where TVL has fallen, borrowing has not recovered strongly, and deleveraging remains incomplete.</p>
<p>Read more: <a href="https://crypto.news/jake-claver-floats-blackrock-xrp-etf-as-xrpl-gains-ground/" rel="noopener noreferrer nofollow"> Jake Claver floats BlackRock XRP ETF as XRPL gains ground </a></p>

DeFi exploit wave erased $13B in TVL, Binance Research says

Table of Contents

crypto.news

Other articles published on Jun 16, 2026

Join our free newsletter for daily crypto updates!