Kelp DAO Suffers $292-293 Million Exploit via LayerZero Bridge, Triggering Cross-Protocol Contagion

Apr 19, 2026

Attackers exploited Kelp DAO's LayerZero-powered bridge on April 18, 2026, draining 116,500 rsETH worth approximately $292-293 million by tricking the cross-chain messaging layer into releasing funds to an attacker-controlled address. The exploit, which occurred at 17:35 UTC and represented 18% of rsETH's circulating supply, triggered emergency freezes across at least nine DeFi protocols including Aave, SparkLend, and Fluid, while Kelp's multisig halted further attacks 46 minutes later. The incident marks 2026's largest crypto hack, surpassing Drift's $285 million April 1 exploit, and caused AAVE token to fall 10% amid bad debt concerns. Multiple protocols including Ethena and Lido took precautionary measures, with Ethena pausing LayerZero bridges and Lido halting deposits to its rsETH-exposed earnETH product while emphasizing their core protocols remain secure.

The Kelp DAO exploit mechanics and immediate response

▪The Kelp DAO bridge that was drained held the rsETH reserve backing wrapped versions of the token deployed on more than 20 other blockchains.
▪Two follow-up exploit attempts at 18:26 UTC and 18:28 UTC both reverted, each carrying the same LayerZero packet attempting another 40,000 rsETH drain worth roughly $100 million.
▪The 116,500 rsETH drained from Kelp DAO represented about 18% of rsETH's 630,000 token circulating supply tracked by CoinGecko.
▪The Kelp DAO exploit was worth roughly $292 million at current prices.
▪An attacker drained 116,500 rsETH from Kelp DAO's LayerZero-powered bridge at 17:35 UTC on Saturday, April 18, 2026.

Cross-protocol contagion and market impact across DeFi

▪Ethena said it has no rsETH exposure and remains more than 101% overcollateralized.
▪AAVE token fell about 10% as the market priced potential bad debt from the Kelp DAO exploit.

2026 DeFi security crisis context

▪Kelp DAO's $292 million loss is the largest DeFi exploit of 2026, overtaking Drift by a few million dollars.
▪Solana-based perpetuals protocol Drift was drained of about $285 million on April 1, 2026 in an attack later linked to North Korea-affiliated actors.
▪At least a dozen smaller DeFi protocols have been exploited in the weeks since April 1, 2026, including CoW Swap, Zerion, Rhea Finance and Silo Finance.