# DeFi security risks and infrastructure shifts

> Live situation record from CLSTR: https://clstr.news/situations/defi-security-risks-and-infrastructure-shifts
> Updated: 2026-08-31T22:00:09.000Z. Sources: 2. Developments: 2.

The KelpDAO bridge exploit, attributed to North Korea’s Lazarus Group, involved the theft of 116,500 rsETH valued at approximately $292 million. The attackers used the stolen assets as collateral on Aave to borrow real ETH, resulting in significant bad debt and a 43% drop in Aave’s total value locked. 

This incident catalyzed a massive migration of approximately $15 billion in assets from LayerZero to Chainlink CCIP, as users expressed concerns regarding LayerZero’s verifier model. 

In response to broader industry losses—including the KelpDAO hack and the Drift Protocol breach—major DeFi players have begun restructuring their presence on low-activity networks, or ‘ghost chains’. Aave is targeting the shutdown of V3 lending deployments across six networks, while LayerZero has removed support for 32 chains. These strategic exits aim to mitigate security risks, specifically addressing vulnerabilities like single-verifier configurations that facilitate cross-chain message spoofing.

## Timeline

### 2026-08-31: Aave and LayerZero exit low-activity ghost chains to mitigate DeFi risks

Aave and LayerZero are exiting low-activity ‘ghost chains’ to combat DeFi security risks following $1.3 billion in exploits during H2 2026.

2 sources. https://clstr.news/cluster/aave-and-layerzero-exit-low-activity-ghost-chains-to-mitigate-defi-risks

### 2026-08-18: KelpDAO exploit triggers $15B DeFi migration and Aave asset decline

A major KelpDAO bridge exploit by North Korean hackers has caused Aave's TVL to drop 43% and triggered a $15 billion migration of DeFi assets from LayerZero to Chainlink.

3 sources. https://clstr.news/cluster/kelpdao-exploit-triggers-15b-defi-migration-and-aave-asset-decline

---
Cite as: DeFi security risks and infrastructure shifts. CLSTR, https://clstr.news/situations/defi-security-risks-and-infrastructure-shifts