The $292 Million Kelp DAO rsETH Exploit: 2026’s Largest DeFi HackOn April 18, 2026, at 17:35 UTC, liquid restaking protocol Kelp DAO lost 116,500 rsETH — 18% of supply, worth $292–294 million — in the year’s biggest DeFi breach. The attack was not a smart-contract bug but a critical misconfiguration in its LayerZero OFT bridge adapter. An attacker forged a cross-chain message, minting unbacked rsETH on Ethereum with no source-chain burn.Kelp DAO, integrated with EigenLayer, lets users deposit stETH/cbETH for liquid rsETH. At exploit time, it held over $1B TVL across 20+ chains via a shared mainnet reserve pool.Timeline Attacker pre-funded via Tornado Cash.
17:35 UTC: Forged lzReceive on LayerZero EndpointV2 (tx: 0x1ae232da212c45f35c1525f851e4c41d529bf18af862d9ce9fd40bf709db4222).
17:52 UTC: ZachXBT flagged it t.me/investigations.
18:21 UTC: Kelp paused contracts, blocking $200M more losses.
1-of-1 DVN (LayerZero Labs only) allowed one forged signature to validate the mint. Multi-DVN was recommended but ignored.
vs Ronin Bridge (2022) Aspect
5/9 validator keys stolen
Configuration is code. Mandate 2-of-3+ DVNs, isolate reserves per chain, add automated circuit breakers, and audit deployments. Heed warnings.Aftermath
$236M bad debt on Aave; freezes and outflows followed. No funds recovered yet.The exploit was preventable. DeFi must treat configs with code-level rigor. Full post-mortems pending.Sources: Etherscan tx, Kelp X statement, ZachXBT Telegram.
areudirty
yousharknotpass
kianamaiart
pixelskylines
andulkaphoto
blakekathryn
theartofmadeline