TLDR
A cross-chain bridge used by KelpDAO was hacked for about $292 million in rsETH, triggering one of DeFis largest systemic shocks so far in 2026.
- Attackers exploited KelpDAOs LayerZero-based bridge, forging cross-chain messages to drain 116,500 rsETH, roughly $292 million and about 18% of rsETH supply.
- The stolen rsETH was used as collateral on lending protocols like Aave, creating over $200 million of bad debt risk and sparking multi-billion-dollar DeFi outflows.
- The incident highlights structural risks in restaking and bridge infrastructure, likely tied to North Koreas Lazarus Group, and is forcing a rethink of cross-chain security and risk limits.
Deep Dive
1. How The KelpDAO Hack Worked
On April 18, an attacker hit KelpDAOs LayerZero-powered cross-chain bridge, draining about 116,500 rsETH, worth around $292 million, in under an hour, making it the largest DeFi exploit of 2026 so far. Reports say the attacker abused a misconfigured 1-of-1 verifier setup in LayerZeros Decentralized Verifier Network, compromising RPC nodes and forcing a failover so forged cross-chain messages were accepted as valid deposits, letting rsETH be minted without real backing. Detailed post-mortems describe this as an infrastructure and configuration failure, not a direct bug in KelpDAOs core smart contracts or LayerZeros base protocol, which is why the blast radius was so wide across interconnected apps.
Even if core contracts are audited, a single weak point in cross-chain plumbing can still enable a nine-figure theft.
2. DeFi Contagion And Aave Impact
After minting unbacked rsETH, the attacker deposited it into lending protocols including Aave V3, Compound, and Euler as collateral, borrowing real ETH and WETH worth roughly $196236 million, leaving protocols with effectively worthless collateral. Aave responded by freezing rsETH and related markets across Ethereum and multiple L2s, but the shock triggered around $56 billion in TVL outflows and pushed some pools to near 100% utilization, making withdrawals difficult and raising bad debt estimates above $200 million in the worst case. Several other platforms such as SparkLend, Fluid, Lidos rsETH-linked products, and various yield protocols paused or limited rsETH exposure to contain the damage.
Even when a single asset is compromised, composability can quickly turn one exploit into a system-wide liquidity crunch.
3. Systemic Risks And What To Watch
LayerZeros preliminary analysis says the operation was likely conducted by North Koreas Lazarus Group (TraderTraitor subunit), consistent with earlier large hacks and sophisticated infrastructure attacks seen in 2026. In response, LayerZero is moving to ban single-verifier bridge configurations, while security researchers push for mandatory multi-verifier DVNs, protocol-level rate limits on bridge flows, and tighter collateral caps on restaking assets. Key forward-looking variables are: KelpDAOs remediation and compensation plan, Aave governance decisions on how to absorb or socialize bad debt, and whether other projects now discover similar misconfigurations in their cross-chain setups.
Restaking and bridge-heavy DeFi designs may need stricter risk controls and hard caps before institutions are comfortable treating them as core collateral.
Conclusion
The KelpDAO exploit was not just a large theft; it exposed how a single misconfigured bridge can cascade into a sector-wide liquidity and trust crisis. Until cross-chain infrastructure, verifier redundancy, and collateral limits are significantly hardened, highly composable DeFi stacks will remain vulnerable to similar systemic shocks.
CoinsKid.Com