Kelp DAO Exploit Drains $292M, 2026’s Biggest DeFi Hack

The Kelp DAO exploit is now the biggest DeFi hack of 2026, and the damage runs deeper than one drained bridge. At17:35 UTC on Saturdayan attacker fed a spoofed cross-chain message intoKelp DAO‘s LayerZero-powered bridge and walked away with116,500 rsETHworth roughly$292 millionat current prices. That reserve backed wrapped versions of rsETH deployed on more than20 blockchains. All of them are now sitting on an empty vault.

How the Kelp DAO Exploit Emptied a $292M Bridge

Cross-chain bridges live and die by the quality of their message validation. Kelp DAO’s bridge died on Saturday. The attacker crafted an instruction that convincedLayerZero‘s cross-chain messaging layer it had originated from a legitimate source network. LayerZero is the infrastructure that lets blockchains send verified instructions to each other, the operative word being ‘verified.’ That verification failed here, and Kelp’s bridge dutifully released116,500 rsETHto an attacker-controlled wallet.

The drain completed in one transaction. Forty-six minutes later, at18:21 UTCKelp’s emergency pauser multisig froze the protocol’s core contracts. Two follow-up attempts hit the chain at18:26 UTCand18:28 UTCeach carrying a LayerZero packet targeting another40,000 rsETHworth around$100 million. Both reverted. The multisig had gotten there just in time, barely.

Kelp posted its first acknowledgment on X at20:10 UTCnearly three hours after the initial drain. The protocol said it was investigating alongside LayerZero, Unichain, its auditors, and outside security specialists. No disclosure has been made yet about exactly how the bridge’s validation logic was bypassed.

What Happens to rsETH Holders on Layer 2s?

Why are rsETH holders on Layer 2 networks at risk?

rsETH holders on Ethereum proper are in a different situation from everyone else. ThersETHbridge reserve, the pool of tokens that gave wrapped versions on every layer 2 their underlying value, is gone. Arbitrum, Base, Linea, Blast, Mantle, Scroll, every deployment sits on top of a claim that can no longer be honored from the bridge.

The feedback loop here is ugly. Panic redemptions from L2 holders pressure the unaffected Ethereum-side supply. If enough wrapped rsETH tries to exit at once, Kelp may need to unwind its EigenLayer restaking positions to cover those withdrawals. That means unwinding yield positions in a fire-sale environment, not ideal.

For context: Kelp DAO is a liquid restaking protocol. It takes user-deposited ETH, routes it through EigenLayer to earn extra yield on top of standard Ethereum staking rewards, and issues rsETH as the tradeable receipt for that position. The bridge that got drained was the piece connecting Ethereum’s rsETH supply to its cross-chain siblings. Strip that out, and the siblings have nothing concrete holding their peg.

DeFi’s Contagion Radius, Aave, Lido, Ethena All Hit

The blast radius extended well beyond Kelp within hours. Aave froze rsETH markets on both V3 and V4 after the exploit. Aave founder Stani Kulechov confirmed that Aave’s own contracts were not compromised and that the threat was entirely external, but AAVE token still dropped roughly10%as the market started pricing in potential bad debt from rsETH used as collateral. That number later got worse: the token fell16%as attackers reportedly used the drained rsETH as collateral to borrow wrapped ether from Aave, sticking the protocol with quantifiable bad debt.

SparkLend and Fluid both froze their rsETH markets as well. Lido Finance paused further deposits into its earnETH product, which carries rsETH exposure, while emphasizing that stETH, wstETH, and the core Lido staking protocol were completely unaffected. Ethena went one step further and temporarily paused all LayerZero OFT bridges from Ethereum mainnet as a precaution, even though Ethena has no direct rsETH exposure and claims to be more than101% overcollateralized. The pause was expected to last roughly six hours while the root cause was identified.

That’s the part that deserves attention. Ethena paused bridges it didn’t have to pause, because right now, nobody fully trusts that their LayerZero integration doesn’t share some flaw with the one that just got exploited.

Is 2026 the Worst Year for DeFi Hacks Yet?

Kelp’s$292 millionloss officially makes this the largest DeFi exploit of2026overtaking the Drift hack by a few million dollars. Solana-based perpetuals protocol Drift was drained of about$285 milliononApril 1in an attack later attributed to North Korea-affiliated actors. That attack seemed like the ceiling. It wasn’t.

At least a dozen smaller protocols have been exploited in the weeks between Drift and Kelp, CoW Swap, Zerion, Rhea Finance, and Silo Finance among them. There’s a pattern forming here, and it’s not subtle. DeFi is in an unusually hostile stretch. Bridges and cross-chain messaging layers keep showing up as the point of failure. The attack surface is enormous, validation logic is complex, and once an attacker finds the right spoofed packet, the damage is instant and irreversible.

The Kelp exploit is also a direct stress test for the LayerZero OFT standard, the cross-chain token framework that dozens of protocols rely on. If the root cause analysis points to a flaw in OFT validation rather than Kelp-specific implementation, the cleanup will be much larger than one protocol. Whether rsETH can hold its peg through the weekend depends on how much of the cross-chain float tries to redeem, and whether Kelp can recover any portion of stolen funds before the trail goes cold. The attacker’s likely next stop is Tornado Cash. Clock’s ticking.

This article is for informational purposes only and does not constitute investment advice. Every investment and trading decision involves risk. Readers should conduct their own research before making any financial decisions.