At 1:35 AM UTC+8 on April 19, hackers attacked Kelp DAO's OFT cross-chain bridge built on LayerZero. By forging cross-chain messages, they tricked the system into minting and transferring 116,500 rsETH (~18% of total supply), resulting in an estimated loss of $292–$294 million. The incident marks the largest DeFi security event so far in 2026.
Message Forgery and a Second Attempt Blocked
On-chain data shows the attacker prepared funds via Tornado Cash and waited about 10 hours before striking. The exploit leveraged LayerZero's lzReceive function. A subsequent attempt to steal another 80,000 rsETH (worth ~$200M) was foiled when Kelp DAO paused contracts within 46 minutes.
Lending Protocols Under Pressure
After the theft, the hacker deposited the stolen rsETH as collateral into Aave V3/V4, SparkLend, and Fluid, borrowing large amounts of WETH/ETH. When rsETH was flagged as compromised, those platforms faced significant bad debt risk. Aave froze its rsETH markets on both V3 and V4, suspending deposits and borrows. The episode highlights the "DeFi Lego" risk: a single bridge bug triggered a cascade across protocols.
Emergency Response and Ongoing Probe
Kelp DAO paused rsETH contracts on Ethereum mainnet and multiple L2s within 46 minutes. It is working with LayerZero, Unichain, audit firms, and external security experts. By the afternoon of April 19, the hacker had swapped ~$250M of stolen tokens into ETH. Researchers ZachXBT and PeckShield are tracking the address.
The breach is classified as a cross-chain bridge and messaging layer vulnerability (LayerZero OFT), not a direct attack on Kelp DAO's core staking contracts. Cross-chain liquidity remains severely impaired, and wrapped ether on several chains is stuck. Due to the holiday timing, DeFi platforms were slow to react. Users with assets in affected protocols are advised to move funds to self-custody. Compensation plans for impacted protocols and users have not yet been disclosed.