A devastating exploit rocked the decentralized finance (DeFi) space on Saturday, April 4, 2026, as Kelp DAO, a leading liquid restaking protocol, suffered a massive $292 million drain of its restaked ether (rsETH) token. The attack, which targeted Kelp’s LayerZero-powered cross-chain bridge, has far-reaching consequences, casting a shadow over the restaking ecosystem and triggering a cascading liquidity crisis across multiple blockchains.
The incident, occurring at 17:35 UTC, saw an attacker trick LayerZero’s messaging layer into authorizing a massive withdrawal of 116,500 rsETH. This amount represents a staggering 18% of the token’s total circulating supply. The sheer scale of the theft makes it the largest DeFi exploit of 2026, surpassing the recent Drift Protocol hack.
The Exploit: Deception at the Messaging Layer
Kelp DAO leverages LayerZero’s infrastructure to enable the movement of rsETH across more than 20 different blockchains. Users stake their ETH through Kelp, which routes it through EigenLayer to earn additional yield, issuing rsETH as a tradeable receipt. This cross-chain architecture proved to be the Achilles' heel.
The attacker successfully tricked LayerZero's cross-chain messaging layer into believing a valid instruction had arrived from another network. This triggered the bridge to release the reserve to an attacker-controlled address. By the time Kelp’s emergency pauser multisig froze the core contracts 46 minutes later, the damage was done. Two follow-up attempts to drain an additional $100 million were successfully reverted.
#Dao #AltcoinRecoverySignals? #USInitialJoblessClaimsBelowForecast