#KelpDAOExploitFreeze *Kelp DAO Exploit & Freeze – April 18, 2026*

This is now the *largest DeFi exploit of 2026*: $292M-$293M drained from Kelp DAO. Here’s what happened and what’s frozen:

*1. The exploit*

- *When*: Saturday, April 18, 2026 at ∼17:35 UTC / 5:35 PM UTC

- *What was hit*: Kelp’s LayerZero-powered cross-chain bridge for rsETH

- *How*: Attacker spoofed LayerZero’s cross-chain messaging. The setup used a 1-of-1 DVN (single signer) instead of 2-of-2, creating a single point of failure. A leaked/compromised source-chain private key let the attacker issue a fake message

- *Stolen*: 116,500 rsETH = ∼$292M, about 18% of rsETH’s total circulating supply

- *Speed*: Gone in one transaction. Two follow-up attempts for another $100M failed after Kelp paused #KelpDAOExploitFreeze

*2. What Kelp DAO froze*

Kelp’s emergency pauser multisig froze core contracts 46 minutes after the drain, at 18:21 UTC:

- *Paused*: rsETH contracts across Ethereum mainnet and several L2s

- *Status*: Deposits/withdrawals halted while they investigate with LayerZero, Unichain, auditors

- *User funds*: Team said deposited ETH in smart contracts remains safe - bug hit minting/bridge, not custody

*3. DeFi-wide freezes & fallout*

Because rsETH was used as collateral everywhere, other protocols froze markets to contain contagion:

*Aave V3/V4*

- *Froze*: rsETH markets + WETH reserves on Ethereum, Arbitrum, Base, Mantle, Linea

- *Why*: Attacker deposited stolen rsETH as collateral and borrowed ∼126,000 WETH = $236M

- *Impact*: $177M-$200M in bad debt. $5.4B+ outflows, TVL down 24%, AAVE token -17.7%

- *Note*: Aave’s contracts weren’t exploited - issue was rsETH collateral

*Others that froze/paused*:

- *SparkLend & Fluid*: Froze rsETH markets. SparkLend had zero exposure

- *Lido Finance*: Paused deposits into earnETH product due to rsETH exposure. stETH unaffected

- *Ethena*: Shut LayerZero bridges from Ethereum mainnet as precaution, despite no rsETH exposure

- *Compound V3, Euler*: Also had debt positions from attacker #KelpDAOExploitFreeze #Write2Earn $ETH