Key Takeaways
- • Ethereum's combined stablecoin and tokenized fund market capitalization fell 19%, from $206.7 billion in April 2026 to approximately $168 billion by early November 2026, according to Crypto Briefing.
- • The decline traces to the KelpDAO exploit on April 18, 2026, in which attackers drained roughly $292 million (116,500 rsETH) in 46 minutes by compromising a single LayerZero decentralized verifier node (DVN).
- • Stablecoin supply on Ethereum stood at approximately $135 billion as of November 9, 2026, accounting for the bulk of the $168 billion total.
- • Industry-wide total value locked fell by $8–14 billion immediately after the exploit, and lending protocols including Aave faced liquidity pressure as users withdrew funds.
- • On November 9, 2026, KelpDAO's parent Evercrest Technologies sued LayerZero Labs and its CEO over alleged negligence and security and disclosure failures; these remain unproven allegations, and LayerZero has attributed the attack to North Korea's Lazarus Group.
Summary
Ethereum's market for dollar-pegged stablecoins and tokenized funds has contracted 19% since the KelpDAO exploit, sliding from $206.7 billion to approximately $168 billion between April and early November 2026, according to Crypto Briefing. Because stablecoins and tokenized funds form the cash layer of decentralized finance, the contraction reduces the capital available to protocols built on top of it.
The breach began on April 18, 2026, when attackers took roughly $292 million, or 116,500 rsETH, from KelpDAO within 46 minutes. The entry point was KelpDAO's bridge infrastructure, where the attackers compromised a single LayerZero decentralized verifier node. With control of that node, they manipulated cross-chain messages and minted tokens with no backing.
The damage spread beyond KelpDAO. Major lending protocols, Aave among them, faced immediate liquidity strain as users rushed to withdraw funds. Industry-wide total value locked fell by $8–14 billion right after the exploit. As of November 9, 2026, Ethereum's stablecoin supply was approximately $135 billion, which the report identifies as the largest component of the overall decline, with tokenized funds making up the remainder.
The dispute has moved to the courts. On November 9, 2026, KelpDAO's parent company, Evercrest Technologies, filed suit against LayerZero Labs and its CEO, alleging negligence and failures around security and disclosure tied to the exploit. These are allegations that have not been tested in court. LayerZero has attributed the attack to North Korea's Lazarus Group.
For investors, the immediate concern is liquidity: a smaller stablecoin base on Ethereum leaves less capital available in DeFi, and the exploit has prompted holders to reassess higher-risk yield products that drew substantial inflows through 2026. Key indicators to monitor include whether Ethereum's stablecoin supply stabilizes, how Aave and other lending protocols manage liquidity, and what the Evercrest case reveals about cross-chain bridge security during discovery.
The breach began on April 18, 2026, when attackers took roughly $292 million, or 116,500 rsETH, from KelpDAO within 46 minutes. The entry point was KelpDAO's bridge infrastructure, where the attackers compromised a single LayerZero decentralized verifier node. With control of that node, they manipulated cross-chain messages and minted tokens with no backing.
The damage spread beyond KelpDAO. Major lending protocols, Aave among them, faced immediate liquidity strain as users rushed to withdraw funds. Industry-wide total value locked fell by $8–14 billion right after the exploit. As of November 9, 2026, Ethereum's stablecoin supply was approximately $135 billion, which the report identifies as the largest component of the overall decline, with tokenized funds making up the remainder.
The dispute has moved to the courts. On November 9, 2026, KelpDAO's parent company, Evercrest Technologies, filed suit against LayerZero Labs and its CEO, alleging negligence and failures around security and disclosure tied to the exploit. These are allegations that have not been tested in court. LayerZero has attributed the attack to North Korea's Lazarus Group.
For investors, the immediate concern is liquidity: a smaller stablecoin base on Ethereum leaves less capital available in DeFi, and the exploit has prompted holders to reassess higher-risk yield products that drew substantial inflows through 2026. Key indicators to monitor include whether Ethereum's stablecoin supply stabilizes, how Aave and other lending protocols manage liquidity, and what the Evercrest case reveals about cross-chain bridge security during discovery.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.