Kelp DAO Hit by $293M Exploit in Largest DeFi Hack of 2026
An attacker drained 116,500 rsETH from Kelp DAO's LayerZero bridge, triggering emergency freezes across nine protocols and a $6B TVL drop at Aave.
Kelp DAO, a liquid restaking protocol with $1.57 billion in TVL, lost roughly $293 million on April 18 after an attacker exploited a flaw in its LayerZero-powered cross-chain bridge, making it the largest DeFi exploit of 2026.
What Happened
The attacker forged a cross-chain message through LayerZero's messaging layer, tricking Kelp's bridge into believing a valid instruction had arrived from another network. The bridge then released 116,500 rsETH, roughly 18% of the token's total circulating supply, to an attacker-controlled address.
Within minutes, the stolen rsETH was deposited as collateral on Aave's lending protocol, where the attacker borrowed over $200 million in wrapped ether before the community detected the unbacked collateral. Kelp activated emergency controls approximately 46 minutes after the initial exploit, freezing deposits, withdrawals, oracle functions, and the rsETH token itself.
Why It Matters
The damage spread well beyond Kelp. At least nine DeFi protocols scrambled to freeze markets or deploy damage control measures. Aave recorded a $6 billion drop in total value locked, and its AAVE token fell 16% as traders priced in the risk of unbacked collateral sitting in the protocol's lending pools.
The exploit highlights persistent vulnerabilities in cross-chain bridge infrastructure. Despite years of high-profile bridge hacks, the LayerZero messaging layer, which underpins interoperability for dozens of protocols, proved susceptible to forged instructions. The incident raises fresh questions about how liquid restaking protocols manage bridge security as they expand across multiple chains.
What to Watch
Analysts suggest the most realistic recovery path involves negotiating a 10-15% bounty with the hacker to return the bulk of the stolen funds. Kelp DAO says it is working with LayerZero, auditors, and security firms to investigate the root cause. Aave founder Stani Kulechov confirmed that Aave's own smart contracts were not compromised, but rsETH markets on V3 remain frozen pending resolution.
Key Takeaways
This is a developing story. Kelp DAO has urged users to follow only official channels for updates as recovery efforts continue.
