An attacker drained 116,500 rsETH from Kelp DAO's LayerZero bridge, triggering emergency freezes across nine protocols and a $6B TVL drop at Aave.
Kelp DAO, a liquid restaking protocol with $1.57 billion in TVL, lost roughly $293 million on April 18 after an attacker exploited a flaw in its LayerZero-powered cross-chain bridge, making it the largest DeFi exploit of 2026.
The attacker forged a cross-chain message through LayerZero's messaging layer, tricking Kelp's bridge into believing a valid instruction had arrived from another network. The bridge then released 116,500 rsETH, roughly 18% of the token's total circulating supply, to an attacker-controlled address.
Within minutes, the stolen rsETH was deposited as collateral on Aave's lending protocol, where the attacker borrowed over $200 million in wrapped ether before the community detected the unbacked collateral. Kelp activated emergency controls approximately 46 minutes after the initial exploit, freezing deposits, withdrawals, oracle functions, and the rsETH token itself.
The damage spread well beyond Kelp. At least nine DeFi protocols scrambled to freeze markets or deploy damage control measures. Aave recorded a $6 billion drop in total value locked, and its AAVE token fell 16% as traders priced in the risk of unbacked collateral sitting in the protocol's lending pools.
The exploit highlights persistent vulnerabilities in cross-chain bridge infrastructure. Despite years of high-profile bridge hacks, the LayerZero messaging layer, which underpins interoperability for dozens of protocols, proved susceptible to forged instructions. The incident raises fresh questions about how liquid restaking protocols manage bridge security as they expand across multiple chains.
Analysts suggest the most realistic recovery path involves negotiating a 10-15% bounty with the hacker to return the bulk of the stolen funds. Kelp DAO says it is working with LayerZero, auditors, and security firms to investigate the root cause. Aave founder Stani Kulechov confirmed that Aave's own smart contracts were not compromised, but rsETH markets on V3 remain frozen pending resolution.
This is a developing story. Kelp DAO has urged users to follow only official channels for updates as recovery efforts continue.
A CAPO oracle misconfiguration on Aave caused 34 users to lose positions worth $27M, with full reimbursement pledged by the DAO.
Key Aave contributor BGD Labs will end all technical work on April 1, citing centralization concerns and friction with Aave Labs over v4 development.
The DeFi lending protocol faces internal conflict over brand control and fee allocation, triggering a whale sell-off while founder Stani Kulechov buys the dip.
Disclaimer: News content is for informational purposes only and should not be considered financial advice. Market conditions can change rapidly. Always conduct your own research.
