Ethereum

DeFi

Euler

<h2 id="b-tldr-b">TLDR:</h2>
<ul>
 <li>An attacker drained 116,500 rsETH worth $292M from Kelp DAO’s LayerZero-powered bridge in one attack.</li>
 <li>Stolen rsETH was deposited on Aave, Compound, and Euler as collateral to borrow ETH, creating bad debt.</li>
 <li>Kelp DAO paused rsETH contracts on Ethereum mainnet and multiple L2s while coordinating with security experts.</li>
 <li>Over $600M was stolen from more than 10 DeFi protocols in two weeks, with AI accelerating hacker capabilities.</li>
</ul>
<a href="https://blockonomi.com/commerce-yields-could-be-the-next-big-defi-yield-segment-as-kelpdao-prepares-for-launch/" rel="noopener noreferrer nofollow">Kelp DAO</a> suffered a major security breach involving its LayerZero-powered rsETH cross-chain bridge. The attacker drained 116,500 rsETH tokens worth approximately $292 million from the protocol. 
The stolen assets were then used as collateral on major lending platforms to borrow ETH. Kelp DAO paused rsETH contracts across the Ethereum mainnet and several Layer 2 networks amid the crisis. 
Security experts from multiple organizations quickly joined the investigation as it got underway.
<h2 id="b-how-the-kelp-dao-rseth-bridge-exploit-unfolded-b">How the Kelp DAO rsETH Bridge Exploit Unfolded</h2>
The attacker targeted the <a href="https://parameter.io/layerzero-beats-three-rivals-in-110m-stargate-protocol-bidding-war/" rel="noopener noreferrer nofollow">LayerZero</a> bridge within Kelp DAO’s cross-chain system. Some 116,500 rsETH tokens were drained during the attack. 
The stolen funds were transferred to lending platforms including Aave, Compound, and Euler. There, the attacker used rsETH as collateral to borrow ETH, creating bad debt across those protocols.
Kelp DAO confirmed the breach through its official X account that day. The protocol stated it had identified suspicious cross-chain activity involving rsETH.
<div class="embed-twitter">
 <blockquote class="twitter-tweet">
 Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.
 We are working with <a href="https://twitter.com/LayerZero_Core?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@LayerZero_Core</a>, <a href="https://twitter.com/unichain?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">@unichain</a>, our auditors and top security experts on RCA.
 We will keep you…
 — Kelp (@KelpDAO) <a href="https://twitter.com/KelpDAO/status/2045595819035046148?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">April 18, 2026</a>
 </blockquote>
</div>
Contracts were paused across mainnet and several Layer 2 networks accordingly. The team coordinated with LayerZero, Unichain, auditors, and security experts on root cause analysis.
Aave and several protocols froze or paused rsETH-related markets in response. This step aimed to limit further losses across affected platforms. 
The <a href="https://moneycheck.com/aave-aave-reaches-historic-1-trillion-lending-milestone-whats-next-for-the-token/" rel="noopener noreferrer nofollow">AAVE token</a> fell to $99.60 amid reports of growing bad debt from the exploit. Activity in impacted markets slowed as users closely tracked the situation.
Kelp DAO advised users to rely solely on its official handle for accurate updates. No attacker was publicly identified while investigations remained active. 
Multiple security firms assisted Kelp DAO’s internal team throughout the analysis process. The full breach scope had not been confirmed at the time of reporting.
<h2 id="b-600-million-stolen-from-defi-protocols-in-two-weeks-b">$600 Million Stolen From DeFi Protocols in Two Weeks</h2>
The Kelp DAO breach came amid a broader wave of DeFi attacks in April 2026. Over $600 million was stolen from more than 10 protocols in two weeks. 
Analyst Jeremy <a href="https://x.com/Jeremybtc/status/2045588919362990431?s=20" rel="noopener noreferrer nofollow">noted that</a> AI is helping hackers execute attacks more efficiently. He identified the Kelp DAO incident as the year’s biggest DeFi hack.
Drift Protocol also lost $285 million to North Korean hackers using AI-powered social engineering. Those hackers spent months building insider trust before striking. 
Once positioned, the full attack unfolded in just 12 minutes. Rhea Finance separately lost $18 million through fake token pools that misled its oracle into approving withdrawals.
Further incidents targeted Grinex, Hyperbridge, Aethir, Dango, and Silo Finance. Grinex, a sanctioned Russian exchange, lost $15 million before suspending all operations. 
An attacker on <a href="https://coincentral.com/hyperbridge-says-polkadot-linked-exploit-losses-climbed-to-2-5-million-in-review/" rel="noopener noreferrer nofollow">Hyperbridge</a> minted one billion fake bridged DOT tokens notionally worth over $1 billion. However, thin liquidity meant only around $237,000 was actually extracted.
CoW Swap and Zerion were also hit in the same two-week stretch. CoW Swap’s frontend was hijacked through a DNS attack that led users to a phishing page. 
Zerion suffered credential theft through North Korean social engineering. The pattern across all these attacks reflects an expanding threat to the broader DeFi sector.
The post <a href="https://blockonomi.com/kelp-dao-rseth-bridge-hack-drains-292m-as-defi-losses-top-600m-in-two-weeks/" rel="noopener noreferrer nofollow">Kelp DAO rsETH Bridge Hack Drains $292M as DeFi Losses Top $600M in Two Weeks</a> appeared first on <a href="https://blockonomi.com" rel="noopener noreferrer nofollow">Blockonomi</a>.

Kelp DAO rsETH Bridge Hack Drains $292M as DeFi Losses Top $600M in Two Weeks

Table of Contents

Blockonomi

Other articles published on Apr 19, 2026

Join our free newsletter for daily crypto updates!