Ethereum

Bitcoin

DeFi

Tornado Cash

Tornado

<p><strong>A Tornado Cash-funded wallet drained 116,500 rsETH from KelpDAO in a cross-chain incident that pushed the protocol into emergency pauses and forced DeFi counterparties to contain exposure.</strong></p>
<div>
 <p>WHAT TO KNOW</p>
 <ul>
  <li>The <a href="https://etherscan.io/tx/0x1ae232da212c45f35c1525f851e4c41d529bf18af862d9ce9fd40bf709db4222" rel="noopener noreferrer nofollow">Etherscan transaction record</a> shows the transfer leaving KernelDAO: Bridge through LayerZero: EndpointV2 and the <code>lzReceive</code> path.</li>
  <li>The <a href="https://etherscan.io/address/0x4966260619701a80637cDbdAc6A6cE0131f8575E" rel="noopener noreferrer nofollow">sending address record</a> is labeled Exploit and shows 1 ETH arriving from Tornado Cash roughly 18 hours earlier.</li>
 </ul>
</div>
<h2 id="what-happened-in-the-kelpdao-rseth-theft">What happened in the KelpDAO rsETH theft</h2>
<p>The transaction hash 0x1ae232da212c45f35c1525f851e4c41d529bf18af862d9ce9fd40bf709db4222 shows rsETH moving from KernelDAO: Bridge to 0x8B1b6c9A6DB1304000412dd21Ae6A70a82d60D3b at 05:35:35 PM UTC on April 18, 2026, and the same trace lists LayerZero: EndpointV2 with the <code>lzReceive</code> function.</p>
<div class="on-chain-data">
 <p>ON-CHAIN DATA</p>
 <ul>
  <li><strong>Execution-time value:</strong> $272,769,334.37</li>
  <li><strong>Sender:</strong> KernelDAO: Bridge</li>
  <li><strong>Recipient:</strong> 0x8B1b6c9A6DB1304000412dd21Ae6A70a82d60D3b</li>
  <li><strong>Method:</strong> LayerZero: EndpointV2 / <code>lzReceive</code></li>
 </ul>
</div>
<p><a href="https://twitter.com/KelpDAO/status/2045595819035046148" rel="noopener noreferrer nofollow">KelpDAO said</a> it identified suspicious cross-chain activity involving rsETH and paused the token's contracts across mainnet and several layer-two networks while it investigated. That broad halt matters because Ethereum bridge and scaling routes are now core operating rails for wrapped assets, a point Bitcoin Info News has also explored in its coverage of <a href="https://bitcoininfonews.com/starknet-leads-layer-2-developer-activity-in-ethereum-scaling-race/" rel="noopener noreferrer nofollow">Ethereum layer-two developer activity</a>.</p>
<p><a href="https://twitter.com/aave/status/2045593585966252377" rel="noopener noreferrer nofollow">Aave said</a> it froze rsETH markets on Aave V3 and Aave V4 and added that its own contracts were not exploited. That response shows the spillover was serious enough for a major lending venue to isolate the asset before wider DeFi repricing could develop.</p>
<h2 id="why-the-tornado-cash-funding-link-matters">Why the Tornado Cash funding link matters</h2>
<p>Etherscan labels the sender as Exploit and shows the wallet receiving 1 ETH from Tornado Cash about 18 hours before the drain. That funding trail matters because it gives investigators a verifiable gas source while still leaving attribution unresolved.</p>
<p>The mixer connection should be treated as wallet history, not identity proof. Based on the address record, the KelpDAO statement, and the Aave freeze notice, the confirmed facts are the seed funding, the bridge outflow, and the defensive response rather than the attacker's name or jurisdiction.</p>
<p>That setup is different from directly traceable bitcoin transfer stories such as <a href="https://bitcoininfonews.com/us-government-moves-bitcoin-linked-to-9-billion-bitfinex-hack/" rel="noopener noreferrer nofollow">the U.S. government move tied to the $9 billion Bitfinex hack</a>, where the wallet path itself was the main evidence. Here, the key proof is a Tornado-funded seed wallet paired with a bridge message that preceded defensive shutdowns across linked protocols.</p>
<h2 id="what-the-theft-could-mean-for-kelpdao-and-rseth">What the theft could mean for KelpDAO and rsETH</h2>
<p><a href="https://cryptobriefing.com/kelp-dao-bridge-hack-292m-loss/" rel="noopener noreferrer nofollow">Crypto Briefing reported</a> the drained balance equaled about 18% of rsETH's roughly 630,000-token circulating supply, which helps explain why containment moved quickly from the bridge into lending markets. That concentration risk landed in an Ethereum ecosystem whose broader positioning Bitcoin Info News recently discussed in coverage of <a href="https://bitcoininfonews.com/ether-advances-vs-bitcoin-as-stablecoin-supply-hits-158b/" rel="noopener noreferrer nofollow">ether strength versus bitcoin and rising stablecoin liquidity</a>.</p>
<p>A single Crypto Briefing report said the attacker may have spoofed LayerZero verification and later framed the incident at roughly $292 million, but the reviewed source set does not include an official postmortem and the Etherscan transaction page priced the executed transfer at $272,769,334.37. Until KelpDAO or an auditor publishes a technical breakdown, the exact failure mode remains unconfirmed.</p>
<p><a href="https://www.coingecko.com/en/coins/ethereum" rel="noopener noreferrer nofollow">CoinGecko showed ETH at $2,345.17</a> during the same stretch, giving the exploit a softer market backdrop than a momentum week and adding to the caution around DeFi collateral. That caution fits the tone of Bitcoin Info News coverage of <a href="https://bitcoininfonews.com/ethereum-spot-etfs-record-207m-net-outflows-as-blackrocks-etha-sheds-285m/" rel="noopener noreferrer nofollow">recent Ethereum spot ETF outflows</a>, where sentiment was already fragile before this bridge shock.</p>
<figure><img src="https://bitcoininfonews.com/wp-content/uploads/2026/04/bitcoininfonews__coingecko__price-chart-59.jpg" alt="CoinGecko price chart for Tornado cash-funded wallet steals 116,500 rsETH from KelpDAO">
 <figcaption>
  CoinGecko market data view included to frame the latest move in ethereum.
 </figcaption>
</figure>
<h2 id="outlook-for-kelpdao-and-cross-protocol-risk">Outlook for KelpDAO and cross-protocol risk</h2>
<p>The next decision points are whether KelpDAO can reopen rsETH contracts and whether Aave lifts its freeze once bridge risk is better bounded. For readers who anchor on bitcoin's simpler settlement model, the contrast is that this event is documented through Ethereum bridge messaging and protocol pauses, not through any failure of Bitcoin's base-layer transfer rules.</p>
<p>The broader lesson is that a bridge event can jump from a wrapped asset into lending venues when the on-chain trail already shows mixer-funded preparation and the execution-time valuation is large enough to force an Aave market freeze. That combination of funding obfuscation and protocol contagion is what makes this incident more than a single wallet movement.</p>
<p>Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p><a href="https://bitcoininfonews.com/" rel="noopener noreferrer nofollow">Bitcoininfonews</a> first published the article titled <a href="https://bitcoininfonews.com/?p=36098" rel="noopener noreferrer nofollow">Tornado Cash-Funded Wallet Steals 116,500 rsETH From KelpDAO</a>.</p>

Tornado Cash-Funded Wallet Steals 116,500 rsETH From KelpDAO

Table of Contents

BitcoinInfoNews.Com

Other articles published on Apr 19, 2026

Join our free newsletter for daily crypto updates!