Biggest 2026 DeFi hack drains over $280M

TLDR

The biggest DeFi hack of 2026 so far is the Kelp DAO rsETH exploit, which drained roughly 292 to 294 million dollars from its cross chain bridge.

1. An attacker abused Kelp DAOs LayerZero powered rsETH bridge on 18 April, draining about 116,500 rsETH, around 18% of supply, worth roughly 292 to 294 million dollars.
2. The stolen rsETH was used as collateral across lending protocols like Aave, Compound and others, creating large bad debt and forcing emergency freezes across multiple DeFi platforms.
3. The case exposes systemic risks around liquid restaking tokens and bridge designs, so the key things to watch are rsETH redemptions, protocol recovery plans and security changes to cross chain infrastructure.

Deep Dive

1. What Actually Happened

Reports from several outlets say Kelp DAOs liquid restaking token rsETH was hit by a bridge exploit on 18 April 2026, draining about 116,500 rsETH, roughly 18% of its circulating supply, worth around 292 million dollars at the time. CoinDesk and Tokenpost both describe it as the largest DeFi exploit of 2026, narrowly eclipsing the earlier Drift Protocol hack.

Security firms and follow up analysis indicate the attacker exploited Kelps LayerZero based bridge logic, tricking the cross chain messaging layer into treating a forged message as valid so the bridge released rsETH to an attacker controlled address. Kelps emergency multisig paused core contracts roughly 45 minutes later, reportedly blocking further attempted drains.

2. How the Damage Spread Through DeFi

The drained rsETH did not just sit idle. According to detailed analysis from CryptoPotato, the attacker deposited fake rsETH into lending protocols such as Aave V3, Compound V3 and Euler, then borrowed more than 236 million dollars worth of WETH and other assets, leaving those protocols with bad debt when the collateral proved unbacked.

Because Kelps bridge backed rsETH on more than 20 networks, doubts quickly spread about whether rsETH on layer 2s was still fully backed, prompting emergency freezes on Aave, SparkLend, Fluid and others and hitting the AAVE token by around 10% to 18 percent. This followed an earlier April Drift exploit near 280 to 286 million dollars on Solana, so DeFi is already on edge.

3. Key Risks and What To Watch Next

Kelps team has acknowledged the incident and paused rsETH contracts while working with LayerZero, auditors and security firms, but there is still uncertainty over how much can be recovered and whether rsETH redemptions will be fully honored across networks. If rsETH trades at a sustained discount or redemptions are gated, that would be a visible sign of lasting damage.

For the broader market, the main watchpoints are: any changes to bridge validation models, diversification away from single restaking tokens as collateral, and whether regulators or large institutions cite this as a reason to be more cautious on DeFi credit risk.

Conclusion

The Kelp DAO rsETH exploit is now the largest DeFi hack of 2026 by lost value, and its impact goes beyond one protocol because rsETH sat at the center of many lending and restaking loops. The incident highlights that cross chain bridges and highly composable liquid restaking tokens can act as systemic risk nodes, where a single failure propagates widely. How quickly Kelp, LayerZero and affected protocols shore up their designs and address bad debt will shape confidence in Ethereum based DeFi for the rest of the year.