PANews reported on May 27th that, according to The Block, since the KelpDAO cross-chain bridge attack in mid-April, the total value locked (TVL) in DeFi has decreased by approximately 14%, from about $172 billion to $148 billion. The attackers exploited vulnerabilities in off-chain infrastructure, rather than smart contracts, to steal approximately $292 million, exposing new infrastructure risks.

The outflow of funds has continued for more than five weeks, indicating that investors are broadly withdrawing marginal capital, rather than targeting specific attacked protocols. Lending, the largest DeFi category, saw the largest drop in total value locked (TVL), falling from approximately $53 billion to $40 billion. Liquidity restaking protocols also experienced a significant decline. The KelpDAO attack demonstrates that as smart contract security improves, off-chain infrastructure is becoming a more vulnerable attack surface.