On April 19, 2026, Kelp, a liquid staking protocol with $1.57 billion in total value locked (TVL), was exploited resulting in $294 million in losses within minutes. According to reports from AMBCrypto, the attack focused on KelpDAO Restaked ETH (RSETH), with the illicit actor minting 116,500 RSETH worth $294 million and selling these as collateral to borrow 106,467 ETH. The exploiter employed a sophisticated dual strategy, depositing the minted tokens into lending platforms like Aave to generate collateral for borrowing ETH while simultaneously selling smaller proportions directly to the open market. Despite Kelp being able to pause the protocol within 46 minutes, the damage had already become irreversible by that time.
A detailed analysis revealed that LayerZero, a cross-chain messaging layer, acted as a bridge in the exploit through a critical infrastructure flaw. As reported by AMBCrypto, the wrongdoer exploited a 1/1 validator set Decentralized Verifier Network (DVN) configuration, where one devious or faulty validator could sign malicious transactions for permissionlessly bypassing security protocols. This represents a significant design flaw, creating a central point of failure in a decentralized system. The LayerZero team confirmed they are in "active remediation" with the KelpDAO team to address the situation, with the ZRO token falling by over 22% in the past 24 hours, trading at $1.52 compared to above $2 just two days earlier. This vulnerability extends beyond Kelp, potentially affecting other projects using similar cross-chain architecture.
The exploit had multifold effects across the DeFi ecosystem, with AMBCrypto reporting that rsETH exists across over 20 blockchains including Ethereum L2s. This caused users to immediately redeem or sell their rsETH, putting pressure on remaining funds on Ethereum. The Aave team froze Aave V3 and Aave V4 platforms, with their token AAVE dropping over 20% in 24 hours to trade at $92.06. Additionally, whales holding AAVE started dumping the token as the incident unfolded. Ethena and Lido Finance also paused their LayerZero bridges as a precautionary measure. The aftermath quickly spread across the wider crypto space, with related tokens and leveraged bets getting hit. A notable case involved a whale long on HyperLiquid experiencing a $2.88 million liquidation, with the position incurring an unrealized loss of more than $750,000 but the trader remaining in the position. The KelpDAO price dropped from $2 to $1.40 after the breach announcement, resulting in leveraged traders facing partial liquidation.
This attack represents the biggest DeFi hack of 2026 so far, with over $600 million stolen from DeFi across more than 10 different protocols over the last two weeks. Recent incidents include Rhea Finance witnessing an $18.4 million exploit, CoW Swap facing a front-end attack, and Drift Protocol experiencing a $285 million drain. The Zerion platform also suffered a $100K loss from internal company hot wallets. According to AMBCrypto, these breaches collectively paint a troubling picture: DeFi platforms are still fraught with critical security shortfalls, even amid stunning innovation and growth. The increasing complexity of protocols, especially those operating across chains, seems to expand the attack surface that opponents have access to. The broader crypto community is tuning in, hoping to emerge stronger and rebuild the pillars of DeFi on a more resilient foundation.
