$292 Million Gone. Arbitrum Locked The Door.
Kelp DAO, a liquid restaking protocol, was hit for $292 million in the largest DeFi exploit of 2026. The attacker targeted Kelp's LayerZero-powered cross-chain bridge, draining 116,500 rsETH and leaving wrapped tokens stranded across more than 20 blockchain networks.
As part of the damage control response, Arbitrum stepped in and locked $71 million in ETH linked to the exploit while the investigation continues.
The attacker wasn't even subtle about what came next. Instead of cashing out, they deposited the stolen rsETH into Aave as collateral and borrowed roughly $190 million in ETH. Aave froze its rsETH markets within hours and is now facing potential bad debt of between $124 million and $230 million. 😬
Meanwhile, Kelp and LayerZero are publicly blaming each other. Kelp says the compromised setup relied on LayerZero's own defaults. LayerZero says Kelp ignored guidance on multi-verifier redundancy. The Spiderman pointing meme is writing itself.
Over $500 million has been drained across the Drift and Kelp exploits in just two weeks. Investigators are pointing to North Korea's Lazarus Group. ☕💀