Biggest DeFi hack of 2026? $294mln KelpDAO exploit hits 20+ chains
On the nineteenth of April, Kelp, a liquid staking protocol with $1.57 billion in complete worth locked (TVL), was exploited, with $294 million misplaced in minutes.
As anticipated, on this assault, KelpDAO Restaked ETH (RSETH) was majorly compromised. As per Lookonchain, the illicit actor minted 116,500 RSETH, which is the same as $294 million, and bought these as collateral to borrow 106,467 ETH.
How did LayerZero act as a secret participant?
Although Kelp was in a position to pause the protocol inside 46 minutes, the harm had already turn out to be irreversible.
In actual fact, a extra in-depth evaluation of the exploit make clear the truth that LayerZero—a cross-chain messaging layer—acted as a bridge. Deluding LayerZero with legitimate directions, the wrongdoer was able to receiving 116,500 rsETH from Kelp’s bridge.
Consequently, LayerZero’s token, ZRO, too fell by over 22% previously 24 hours because it was altering fingers at $1.52. This was a serious drop from buying and selling above $2 simply 2 days in the past.
Moreover, the crew at LayerZero got here ahead to tell the victims that they’ve been in “lively remediation with the KelpDAO crew.”
For sure, this assault triggered a multifold impression, as a whale holding ZRO lengthy on Hyperliquid misplaced $2.88 million in liquidation. Although the whale remains to be holding the place, it’s already bearing a lack of $750,000, leading to an general lack of 428.98 million.
Widespread impression and reactiobs
Many within the crypto group are calling this the most important DeFi hack of 2026, which is true given the rsETH exists throughout over 20 blockchains like Ethereum L2s. Now, since customers will need to have run to right away redeem or promote their rsETH, this may need put stress on the remaining funds on Ethereum [ETH].
This liquidity disaster resulted in lots of protocols freezing their platforms to keep away from additional harm. The Aave crew froze Aave V3 and Aave V4, and its token AAVE noticed a drop of over 20% previously 24 hours because it was buying and selling at $92.06.
Concurrently, the whales holding AAVE additionally began dumping the token as quickly because the incident got here into the limelight.
Regardless of Ethena [ENA] having ‘no publicity to the rsETH exploit,’ the crew nonetheless paused their LayerZero OFT bridges from the Ethereum mainnet as an ‘abundance of warning.’
This resulted within the token seeing a modest lack of over 3% as in comparison with others. For sure, Lido Finance was no exception as they adopted the identical method.
Different assaults that shook the crypto world in 2026
All in all, during the last 2 weeks, greater than $600 million was stolen from DeFi throughout over 10 completely different protocols. The latest ones included Rhea Finance witnessing an $18.4 million exploit tied to a slippage flaw.
Secondly, CoW Swap confronted a front-end assault, and Drift Protocol confronted a $285 million drain. Moreover, Zerion confronted a $100K loss from the ‘inside firm scorching wallets,’ and the listing goes on.
Taken collectively, these spotlight how illicit actors are increasing their operational footprint in and round crypto.
Ultimate Abstract
- Inside 46 minutes, KelpDAO was fast to pause all exercise to keep away from additional harm.
- A number of DeFi protocols paused actions on their platform no matter dealing with any main losses.
