🚨 BREAKING — $292 MILLION STOLEN IN 46 MINUTES

2026's Biggest DeFi Hack | Kelp DAO / LayerZero Bridge Exploit

What happened?

On April 18, 2026 at 17:35 UTC, a hacker sent a single fake message through Kelp DAO's LayerZero bridge — and walked away with 116,500 rsETH worth ~$292 million. By the time Kelp hit the emergency pause, 46 minutes had passed and ~$250M had already been swapped into ETH through a Tornado Cash-prepared wallet.

🔴 Damage Report:

$292M stolen from Kelp DAO bridge

$6.6B wiped from Aave's TVL in hours

AAVE token crashed -16%

RAVE token collapsed -90% (from $27 to $1.15)

Aave, SparkLend, Fluid, Lido all paused rsETH markets

20+ chains affected

🔍 Root Cause:

One bridge. One signer. One fake message. That's all it took. A single approval key controlled the entire bridge — when it was fooled, there was nothing to stop it.

⚠️ The Bigger Picture:

Q1 2026 alone saw $482M drained from DeFi. This hack pushes 2026 to its worst year on record. The Drift Protocol hack on Solana ($285M) in April already set the tone — Kelp just broke that record.

"Risks show up if everything leans on a single person."

— Michael Egorov, Curve Finance

This isn't just a hack. It's a warning about how DeFi is built.

#KelpDAO #DeFiHack #LayerZero #rsETH #Crypto #Web3Security #DeFi