🚨 BREAKING: $292M KELP DAO EXPLOIT — THE BIGGEST DeFi HACK OF 2026 🚨
The DeFi market just witnessed its most devastating exploit of the year. An attacker drained 116,500 rsETH (~$292M)— nearly 18% of rsETH's total circulating supply — by exploiting Kelp DAO's LayerZero-powered cross-chain bridge at 17:35 UTC on April 18.
🔍 HOW IT HAPPENED: ▪️ Attacker manipulated LayerZero's lzReceive function on the EndpointV2 contract ▪️ Forged a cross-chain message with NO source-chain burn record ▪️ Triggered the mainnet OFTAdapter to release 116,500 rsETH ▪️ Kelp's 1/1 DVN config (weakest LayerZero security tier) was the fatal weak link
💥 THE DOMINO EFFECT ON $AAVE: ▪️ Unbacked rsETH was deposited on Aave V3 → ~$236M in WETH borrowed ▪️ Since rsETH has ZERO backing now, positions are unliquidatable ▪️ Aave's ETH pool utilization = 100% → withdrawals frozen ▪️ $AAVE price crashed 10–13% in hours ▪️ Panic outflows triggered — Justin Sun pulled 65,584 ETH ($154M) alone
🛡️ CONTAGION SPREADING FAST: ✅ Aave froze rsETH markets on V3 & V4 ✅ SparkLend, Fluid, Compound, Euler — all froze rsETH exposure ✅ Lido paused earnETH deposits ✅ Ethena temporarily halted LayerZero OFT bridges ✅ Upshift paused High Growth ETH & Kelp Gain vaults
⚡ THE REAL TEST: This is the first live stress test of Aave's Umbrella safety module. If bad debt materializes, the Aave DAO must decide — absorb the loss or socialize it.
📉 KEY TAKEAWAY: Liquid Restaking Tokens (LRTs) are the most composable AND most fragile collateral in DeFi. When the backing breaks, everything downstream breaks with it.
Stay sharp. Manage exposure. Trust math, not narratives. 💎