Arbitrum Freezes $71 Million in ETH Stolen in Kelp DAO Exploit

Apr 21, 2026

The Arbitrum Security Council froze $71 million in ETH stolen during a $292 million exploit of Kelp DAO's rsETH Liquid Restaking Token, which affected approximately 116,500 rsETH representing 18% of supply. The attack exploited a verification layer issue where one signature tricked LayerZero's cross-chain messaging into believing valid instructions had arrived, with LayerZero and Kelp DAO disputing whether the vulnerability was a protocol bug or configuration issue. The exploit triggered panic across DeFi, with Aave experiencing $6.2 billion in net outflows and its total value locked dropping from $26.4 billion to nearly $20 billion, while the AAVE token fell over 18%. Multiple protocols including Aave and Lido paused rsETH activity, and the incident follows a pattern of recent DeFi exploits including the $285 million Drift hack linked to North Korean actors.

The Kelp DAO exploit and immediate market impact

▪Arbitrum froze $71 million in ETH stolen in the Kelp DAO exploit.
▪Approximately 116,500 rsETH, representing about 18% of supply, was affected in the Kelp DAO exploit.
▪Kelp DAO's rsETH is a Liquid Restaking Token that allows users to earn ether staking and restaking rewards while keeping their assets liquid.
▪The attacker tricked LayerZero's cross-chain messaging layer into believing a valid instruction had arrived from another network in the Kelp DAO exploit.
▪The Kelp DAO exploit resulted in $292 million in losses.

Technical root cause and cross-chain security vulnerabilities

▪The Kelp DAO exploit involved a verification layer issue rather than broken smart contracts.
▪The Kelp DAO exploit was not a LayerZero protocol bug but a configuration issue.
▪LayerZero's configuration can allow a 1/1 DVN setup where the DVN is a single node run by a single entity.
▪A DVN in LayerZero V2 is an independent entity responsible for validating and attesting to the authenticity of messages sent across different blockchain networks.
▪One signature enabled 116,500 rsETH to materialize out of thin air on Ethereum in the Kelp DAO exploit.

Broader contagion effects across DeFi lending platforms

▪Aave's total value locked dropped from $26.4 billion on April 18 to nearly $20 billion on Sunday morning.
▪The Kelp DAO exploit led to withdrawals across all lending protocols, including on Solana and unaffected protocols.
▪Aave experienced negative net inflows of $6.2 billion, representing a 23% decline, following the Kelp DAO exploit.
▪The AAVE token fell more than 18% as depositors scrambled to withdraw their money through the weekend.

Industry response and ongoing investigation

▪At least a dozen smaller DeFi protocols were exploited in the weeks following the Drift hack, including CoW Swap, Zerion, Rhea Finance and Silo Finance.
▪Justin Sun offered to negotiate with the Kelp DAO hacker to prevent Aave and Kelp DAO from going down.
▪Kelp DAO paused rsETH contracts across mainnet and several L2s while investigating the exploit.
▪Solana-based perpetuals protocol Drift was drained of about $285 million on April 1 in an attack linked to North Korea-affiliated actors.
▪Stani Kulechov stated that the Kelp DAO exploit was external and that Aave's contracts were not compromised.

Perspective of Kelp DAO

▪Kelp DAO is collaborating with LayerZero, Unichain, auditors, and security experts to determine the root cause of the $292 million exploit.
▪Kelp DAO paused rsETH contracts across mainnet and several L2s while investigating the exploit.