Aave

Lombard

DeFi

LayerZero

Million

<p><strong>KelpDAO has been hit by a hack reportedly worth around $293 million, making it one of the largest DeFi exploits of 2026. The breach, which targeted the protocol's cross-chain rsETH token infrastructure, has triggered downstream fallout across lending markets and prompted at least one major Bitcoin DeFi issuer to abandon its bridging provider entirely.</strong></p>
<h2 id="what-to-know-about-the-kelpdao-hack">What to Know About the KelpDAO Hack</h2>
<ul>
 <li><strong>Scale:</strong> LayerZero confirmed the April 18, 2026 exploit drained <a href="https://layerzero.network/blog/kelpdao-incident-statement" rel="noopener noreferrer nofollow">approximately $290 million</a> from KelpDAO, isolated to the protocol's rsETH configuration with no contagion to other LayerZero-connected assets.</li>
 <li><strong>Developing story:</strong> The exact loss figure varies across sources, with early reports citing $293 million while primary statements point to roughly $290 million. KelpDAO itself has not published a postmortem, and some details, including final attribution, remain unconfirmed.</li>
</ul>
<h2 id="how-the-exploit-unfolded">How the Exploit Unfolded</h2>
<p>The attack was not a smart-contract bug. According to <a href="https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/" rel="noopener noreferrer nofollow">a Chainalysis analysis</a>, attackers compromised internal RPC nodes and launched a DDoS against external nodes, feeding false data into a 1-of-1 DVN verification path used by LayerZero's infrastructure.</p>
<p>A forged inbound packet from Unichain to Ethereum released <a href="https://governance.aave.com/t/rseth-incident-report-april-20-2026/24580" rel="noopener noreferrer nofollow">116,500 rsETH</a> from the Ethereum-side adapter without any corresponding source-side burn. That single fraudulent message drained the bulk of the adapter's reserves.</p>
<p>After the exploit, only 40,373 rsETH remained confirmed in the adapter against 152,577 remote-chain claims, according to Aave's incident report. The gap between backing and outstanding claims is the core of the downstream damage.</p>
<p>Chainalysis linked the attack to North Korea's Lazarus Group, though that attribution remains preliminary rather than a publicly adjudicated conclusion. Law enforcement became involved after the exploit, and the Arbitrum Security Council froze a portion of downstream funds while coordinating with investigators.</p>
<h2 id="downstream-damage-aave-faces-up-to-230-million-in-bad-debt">Downstream Damage: Aave Faces Up to $230 Million in Bad Debt</h2>
<p>Aave's governance forum published two bad-debt scenarios stemming from the exploit. Under uniform loss socialization, the protocol faces an estimated $123.7 million in bad debt. If losses are isolated to L2 rsETH holders, the figure climbs to $230.1 million.</p>
<p>The scale of potential bad debt from a single bridge exploit underscores the concentration risk that cross-chain lending markets carry. Similar concerns around <a rel="noopener noreferrer nofollow">institutional crypto outflows</a> have surfaced in other corners of the market this year, though the mechanisms differ.</p>
<h2 id="lombard-finance-moves-1-billion-away-from-layerzero">Lombard Finance Moves $1 Billion Away From LayerZero</h2>
<p>The most significant market reaction came from Lombard Finance, which announced it will migrate more than <a href="https://decrypt.co/368100/lombard-finance-dumps-layerzero-chainlink-1-billion-bitcoin-assets" rel="noopener noreferrer nofollow">$1 billion in bitcoin-backed assets</a> from LayerZero to Chainlink CCIP. The move represents a direct vote of no confidence in LayerZero's bridge security following the KelpDAO breach.</p>
<blockquote class="twitter-tweet">
 <p>This decision prioritizes the safety and security of all Lombard users and reflects our commitment to the security record we've maintained since day 1: 0 security incidents, and 100% uptime.</p>— Lombard (@Lombard_Finance) <a href="https://twitter.com/Lombard_Finance/status/2055326882217038099?ref_src=twsrc%5Etfw" rel="noopener noreferrer nofollow">May 15, 2026</a>
</blockquote>
<p>Source: @Lombard_Finance on X</p>
<p>Lombard's migration is notable because it shifts a substantial portion of the Bitcoin DeFi ecosystem's bridged assets to a competing infrastructure provider. For context, the broader crypto market was already under pressure, with Bitcoin trading at $78,093 and the <a href="https://alternative.me/crypto/fear-and-greed-index/" rel="noopener noreferrer nofollow">Fear &amp; Greed Index</a> reading 31, firmly in "Fear" territory.</p>
<figure><img src="https://bitcoininfonews.com/wp-content/uploads/2026/05/bitcoininfonews__coinmarketcap__price-chart-55.jpg" alt="CoinMarketCap price chart for KelpDAO Hit by $293 Million Hack">
 <figcaption>
  CoinMarketCap chart illustrating the price backdrop referenced in this article on KelpDAO.
 </figcaption>
</figure>
<p>The incident follows a period of mixed sentiment for digital assets. Spot Bitcoin ETFs recently recorded <a rel="noopener noreferrer nofollow">$290 million in outflows</a>, and separate <a rel="noopener noreferrer nofollow">developments around BNB and Grayscale ETF filings</a> have kept institutional attention fragmented across multiple narratives.</p>
<h2 id="why-this-breach-matters">Why This Breach Matters</h2>
<p>The KelpDAO exploit exposed a specific architectural weakness: a 1-of-1 verification path where a single compromised data feed could authorize a nine-figure withdrawal. The attack did not require breaking any smart contract logic, only the off-chain infrastructure feeding data to it.</p>
<p>The downstream chain of consequences, from unbacked rsETH claims to Aave bad-debt scenarios to Lombard's billion-dollar migration, illustrates how a single bridge failure can cascade across otherwise unrelated protocols.</p>
<p>KelpDAO has yet to release a first-party postmortem or treasury impact statement. Until it does, the full scope of user losses and any potential recovery plan remain unclear.</p>
<p>Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.</p>
<p><a href="https://bitcoininfonews.com/" rel="noopener noreferrer nofollow">Bitcoininfonews</a> first published the article titled <a href="https://bitcoininfonews.com/?p=36794" rel="noopener noreferrer nofollow">KelpDAO Hit by $293 Million Hack: What Happened</a>.</p>

KelpDAO Hit by $293 Million Hack: What Happened

Table of Contents

BitcoinInfoNews.Com

Other articles published on May 16, 2026

Join our free newsletter for daily crypto updates!