KelpDAO hack wipes $14B from DeFi

TLDR

A roughly $292 million exploit of KelpDAOs rsETH bridge triggered a rapid, fear driven exit of around $13 to $14 billion from major DeFi protocols.

1. An attacker abused KelpDAOs LayerZero based cross chain bridge on April 18 to mint about 116,500 unbacked rsETH worth roughly $292 million and deploy it as collateral on lending platforms.
2. Liquidity fears and market freezes around rsETH pushed users to yank funds from Aave and other protocols, cutting DeFi total value locked by about $13 to $14 billion within two days.
3. Preliminary attribution to North Korea linked Lazarus actors and the bridge design failure highlight structural risks in cross chain infrastructure and restaking collateral that DeFi users now need to reprice.

Deep Dive

1. How The KelpDAO Exploit Worked

KelpDAO is a liquid restaking protocol on Ethereum that issues rsETH, a token representing restaked ETH that can be used in DeFi. rsETH moves across chains via a LayerZero based cross chain bridge.

Over the weekend of 18 April, an attacker forged or manipulated verification for a bridge message, causing the Ethereum side to release about 116,500 rsETH that was not properly backed, worth roughly $292 million at the time, making it the largest DeFi exploit of 2026 so far. Reports describe this as an infrastructure level failure in KelpDAOs single verifier bridge setup rather than a direct bug in its core staking contracts.

The attacker then deposited large amounts of stolen rsETH as collateral on lending protocols like Aave, Compound, and Euler, borrowing hundreds of millions in ETH and related assets against what later became effectively worthless collateral.

2. Why A $292M Hack Led To A $14B DeFi Outflow

Because rsETH was widely accepted as collateral, the exploit immediately created bad debt risk and forced risk controls at major lenders.

Aave, the largest affected lender, saw between about $6 billion and $8.5 billion in deposits leave over roughly 48 hours as markets tied to rsETH were frozen and users rushed to withdraw, with potential bad debt estimated well into nine figures. Sector wide, DeFi total value locked fell from around $99 billion to roughly $85 to $86 billion, a drop of about $13 to $14 billion in one to two days, pushing TVL to a one year low.

Other restaking and yield protocols with rsETH exposure, plus unrelated protocols caught in the general risk off move, also suffered double digit percentage TVL declines, and several chains such as Ethereum, Arbitrum, and Avalanche recorded sharp one day DeFi TVL drops.

3. Emerging Risks And What To Watch

LayerZeros preliminary analysis says the attack likely matches patterns from North Koreas Lazarus Group, specifically its TraderTraitor subunit, underlining that state level actors are now targeting DeFi infrastructure.

In response, LayerZero has said it will no longer approve applications that rely on single verifier configurations, and risk teams across DeFi are tightening collateral lists, caps, and bridge assumptions, especially around restaking tokens like rsETH.

For users, the key risks are that cross chain assets and newer restaking derivatives can fail in ways oracles and lending markets are slow to reflect, and that governance decisions on who eats bad debt can impact depositors, token holders, or both.

Conclusion

The KelpDAO hack shows how a single bridge level failure on a popular restaking token can turn a $292 million theft into a roughly $14 billion DeFi wide liquidity event. Until cross chain verification and collateral standards improve, DeFi yields remain tightly linked to systemic infrastructure risk, and users and protocols alike need to price that risk into where they deploy capital.