Cookie DAO 🍪 (@cookiedotfun): DeFi just had its worst month in history.

DeFi just had its worst month in history. Here's what happened. → On April 18, an attacker spoofed a @LayerZero_Core cross-chain message and tricked the @KelpDAO bridge into releasing roughly $292M to an attacker wallet. → Aave froze rsETH markets within hours. → The @arbitrum Security Council made the most aggressive onchain governance call in DeFi history: injecting upgrade code to override the hacker's private key and freeze $70.9M in their Arbitrum address. → By April 20, the attack was attributed to DPRK's Lazarus Group, the same unit behind the Drift Protocol exploit on April 1. Two $280M+ operations in 18 days, from the same actor. The fallout didn't stay contained. Aave lost $6.2B in TVL in hours, down 23%. Morpho, Sky, and JupLend followed. Total sector exit: ~$15B in 72 hours. Solana protocols with zero direct rsETH exposure saw withdrawals. April 2026 losses now sit at ~$630M. That's more than DeFi lost in all of 2023. What the CT conversation actually looks like. General commentary dominated by volume 37% of all tweets, but the technical analysis posts punched far above their weight, Bridge/Tech Flaw generated nearly the same signal as Market Impact despite half the tweet count. The most damaging critique came from @banteg : "It's really crazy that LayerZero doesn't have some redundant sanity check and allows to bridge 116,500 rsETH from a chain with a supply of 49." He followed it with a full investigation and a list of every remaining 1-of-1 LayerZero bridge still active. The Arbitrum clawback got only 139 tweets but 2,345 signal and 2.9M impressions, concentrated attention on a single action. The community is split: seizing $71M from a likely DPRK actor feels like the right call, but the governance power used to do it makes some people uncomfortable. That tension is real and unresolved. 2 protocols, 2 very different recovery problems. Both Kelp DAO and LayerZero flipped hard negative in sentiment, but they're not in the same position. Kelp absorbed the "protocol that lost users' funds" framing. LayerZero is sitting in "infrastructure under scrutiny" territory. That distinction matters for what recovery actually looks like. Kelp needs to move fast on user compensation and demonstrate the protocol is safe to return to. LayerZero's problem is slower and harder, the 1-of-1 DVN vulnerability narrative is starting to stick with developers, and if it hardens before they address it structurally, the trust damage compounds well beyond this single exploit.