Massive Hack Strikes KelpDAO: A Deep Dive into the Incident

In a significant development within the cryptocurrency space, KelpDAO’s liquid restaking protocol suffered an immense blow due to a hack. This attack, which took place on April 18, 2026, led to the theft of approximately $293 million and primarily impacted the rsETH token. The breach was orchestrated through exploiting vulnerabilities in a bridge contract responsible for transferring tokens across networks.
KelpDAO swiftly responded by identifying suspicious cross-chain activity linked to rsETH and halted operations involving this token across both mainnet and various Layer 2 solutions. The investigation is ongoing as KelpDAO collaborates with partners like LayerZero Core and Unichain along with top security experts.

Unveiling the Exploit: How It Happened

According to Cyvers’ team, attackers leveraged weaknesses within the bridge contract of the rsETH adapter. This component plays a crucial role in facilitating token movements between different blockchain networks. As news of this exploit spread, it triggered a chain reaction among decentralized platforms that depend on rsETH.
At least nine DeFi protocols had exposure to rsETH and were compelled to suspend their activities temporarily. Among these was Aave, which froze its markets related to this asset in versions V3 and V4. Notably, about $250 million of stolen funds have already been converted into Ethereum via addresses associated with Tornado Cash mixer services.

Implications for Decentralized Finance (DeFi)

The incident underscores significant risks tied to DeFi protocols’ reliance on third-party assets and infrastructure. The attack on KelpDAO forms part of an alarming trend of large-scale incidents plaguing the industry. Experts estimate losses from hacks and fraud during Q1 2026 surpassed $500 million.
For instance, Drift Protocol faced an attack amounting to $280 million earlier this April – reportedly prepared over months using social engineering tactics. In response, Tether offered Drift Protocol over $127 million as compensation for losses incurred due to this breach.
Overall, these events highlight pressing challenges faced by stakeholders within today’s rapidly evolving crypto ecosystem while emphasizing critical considerations around security measures necessary for safeguarding digital assets effectively against potential threats moving forward.