Ethereum's market for stablecoins and tokenized funds has contracted 19% in the months since the KelpDAO exploit, with the combined figure sliding from $206.7 billion to approximately $168 billion between April and early November 2026.

The decline carries significance beyond the headline number. Stablecoins, which are designed to track the value of fiat currencies such as the dollar, and tokenized funds, which represent investment products as on-chain tokens, serve as the cash layer of decentralized finance — and when that layer contracts, everything built on top of it has less to work with.

How One Compromised Node Cost $292 Million

The trouble began on April 18, 2026, when attackers made off with roughly $292 million, or 116,500 rsETH — the protocol's liquid restaking token — from KelpDAO in a span of 46 minutes.

The entry point was KelpDAO's bridge infrastructure — specifically, a single LayerZero decentralized verifier node, or DVN, which acts as a notary for cross-chain messages. Once the hackers controlled that verifier, they could manipulate the messages passing through it and used that power to mint tokens that had nothing backing them.

Contagion Moved Faster Than Code

The damage did not stay contained within KelpDAO. Major lending protocols, Aave among them, ran into immediate liquidity problems as users rushed to pull funds. Industry-wide total value locked — the measure of assets parked in DeFi protocols — fell by $8–14 billion right after the exploit.

As of November 9, 2026, stablecoin supply on Ethereum stood at approximately $135 billion. That figure accounts for a significant portion of the overall decline, with tokenized funds making up the rest of the $168 billion total.

Lawsuits and a Familiar Suspect

The fallout has now moved to the courtroom. On November 9, 2026, KelpDAO's parent company, Evercrest Technologies, filed suit against LayerZero Labs and its CEO. The complaint alleges negligence, along with failures around security and disclosure tied to the exploit. Those are allegations, and they have not been tested in court.

LayerZero, for its part, has pointed the finger elsewhere. The company has linked the attack to North Korea's Lazarus Group.

What It Means for DeFi and Ethereum

The most immediate takeaway concerns liquidity: a smaller stablecoin base on Ethereum means less dry powder sitting in DeFi. The research also points to a shift in appetite — higher-risk yield products attracted substantial capital throughout 2026, and the exploit has pushed holders to rethink those positions.

A $292 million loss traced back to the compromise of one verifier node is a stress test that cross-chain bridges failed in public.

For now, the numbers tell the story plainly. Ethereum's stablecoin and tokenized fund market sits around $168 billion, down from $206.7 billion, and the capital that left has shown little urgency about coming back.

The key indicators to track are straightforward: whether Ethereum's roughly $135 billion stablecoin supply stabilizes, how lending protocols like Aave manage liquidity, and what the Evercrest case reveals about bridge security once it reaches discovery.

Disclosure: This article was edited by John Chen.

Source: CryptoBriefing