#KelpDAOExploitFreeze #KelpDAOExploitFreeze 🚨 is the largest DeFi exploit of 2026 so far. Here's what happened:
*Chronology of the Exploit - April 18, 2026:*
- *Loss*: ∼$292M - $294M rsETH drained, ∼18% of total rsETH supply
- *Method*: Hacker manipulated LayerZero cross-chain messaging at the KelpDAO bridge. The bridge was tricked & released 116,500 rsETH to the attacker's wallet at 17:35 UTC
- *Kelp's Response*: 46 minutes later, the team paused the rsETH contract on mainnet + L2. Two follow-up drain attempts of 40,000 rsETH failed 10b3
*Chain Impact on DeFi:*
1. *Bad Debt Aave*: Attacker deposited "empty" rsETH into Aave V3, borrowed 83,427 WETH + wstETH. Generated $177M-$200M bad debt in the Aave wETH pool
2. *Market Freeze*:
- *Aave*: Freeze rsETH markets
- *SparkLend*: Freeze exposure
- *Others*: Fluid, Compound, Euler, etc. took containment steps. Total of 9+ protocols affected
3. *TVL Plummeted*: DeFi TVL decreased by $10B-$14.17B within 24 hours. Aave alone lost $8B, down 32.44% to $17.038B
4. *AAVE Price*: Dropped 10%-22% intraday due to whale dumping 1b486aa6ca0257474c5b
*Why It Spread Quickly:*
rsETH is widely used as collateral in lending. An exploit in one protocol = contagion event. The attacker created "unbacked rsETH", used it to borrow real assets like ETH 6aa6
*Current Status:*
- Aave: Contract not compromised, withdrawals are still ongoing
- KelpDAO: Investigating together with LayerZero, Unichain, auditor
- Attacker: ∼$250M has been swapped to ETH via Tornado Cash 1b4810b3becb
This exploit highlights the significant risks of DeFi "composability" + cross-chain bridges. $14B left the ecosystem in one day. e1fe5747
Want a technical breakdown of the bridge exploit or its impact on other tokens?
*Chronology of the Exploit - April 18, 2026:*
- *Loss*: ∼$292M - $294M rsETH drained, ∼18% of total rsETH supply
- *Method*: Hacker manipulated LayerZero cross-chain messaging at the KelpDAO bridge. The bridge was tricked & released 116,500 rsETH to the attacker's wallet at 17:35 UTC
- *Kelp's Response*: 46 minutes later, the team paused the rsETH contract on mainnet + L2. Two follow-up drain attempts of 40,000 rsETH failed 10b3
*Chain Impact on DeFi:*
1. *Bad Debt Aave*: Attacker deposited "empty" rsETH into Aave V3, borrowed 83,427 WETH + wstETH. Generated $177M-$200M bad debt in the Aave wETH pool
2. *Market Freeze*:
- *Aave*: Freeze rsETH markets
- *SparkLend*: Freeze exposure
- *Others*: Fluid, Compound, Euler, etc. took containment steps. Total of 9+ protocols affected
3. *TVL Plummeted*: DeFi TVL decreased by $10B-$14.17B within 24 hours. Aave alone lost $8B, down 32.44% to $17.038B
4. *AAVE Price*: Dropped 10%-22% intraday due to whale dumping 1b486aa6ca0257474c5b
*Why It Spread Quickly:*
rsETH is widely used as collateral in lending. An exploit in one protocol = contagion event. The attacker created "unbacked rsETH", used it to borrow real assets like ETH 6aa6
*Current Status:*
- Aave: Contract not compromised, withdrawals are still ongoing
- KelpDAO: Investigating together with LayerZero, Unichain, auditor
- Attacker: ∼$250M has been swapped to ETH via Tornado Cash 1b4810b3becb
This exploit highlights the significant risks of DeFi "composability" + cross-chain bridges. $14B left the ecosystem in one day. e1fe5747
Want a technical breakdown of the bridge exploit or its impact on other tokens?