On the 19th of April, Kelp, a liquid staking protocol with $1.57 billion in total value locked (TVL), was exploited, with $294 million lost in minutes.
As expected, in this attack, KelpDAO Restaked ETH (RSETH) was majorly compromised. As per Lookonchain, the illicit actor minted 116,500 RSETH, which is equal to $294 million, and sold those as collateral to borrow 106,467 ETH.
How did LayerZero act as a secret player?
Though Kelp was able to pause the protocol within 46 minutes, the damage had already become irreversible.
In fact, a more in-depth analysis of the exploit shed light on the fact that LayerZero—a cross-chain messaging layer—acted as a bridge. Deluding LayerZero with valid instructions, the wrongdoer was capable of receiving 116,500 rsETH from Kelp’s bridge.
As a result, LayerZero’s token, ZRO, too fell by over 22% in the past 24 hours as it was changing hands at $1.52. This was a major drop from trading above $2 just 2 days ago.
Additionally, the team at LayerZero came forward to inform the victims that they have been in “active remediation with the KelpDAO team.”
Needless to say, this attack caused a multifold impact, as a whale holding ZRO long on Hyperliquid lost $2.88 million in liquidation. Though the whale is still holding the position, it is already bearing a loss of $750,000, resulting in an overall loss of 428.98 million.
Widespread impact and reactiobs
Many in the crypto community are calling this the biggest DeFi hack of 2026, which is true given the rsETH exists across over 20 blockchains like Ethereum L2s. Now, since users must have run to immediately redeem or sell their rsETH, this might have put pressure on the remaining funds on Ethereum [ETH].
This liquidity crisis resulted in many protocols freezing their platforms to avoid further damage. The Aave team froze Aave V3 and Aave V4, and its token AAVE saw a drop of over 20% in the past 24 hours as it was trading at $92.06.
Simultaneously, the whales holding AAVE also started dumping the token as soon as the incident came into the limelight.
Despite Ethena [ENA] having ‘no exposure to the rsETH exploit,’ the team still paused their LayerZero OFT bridges from the Ethereum mainnet as an ‘abundance of caution.’
This resulted in the token seeing a modest loss of over 3% as compared to others. Needless to say, Lido Finance was no exception as they followed the same approach.
Other attacks that shook the crypto world in 2026
All in all, over the last 2 weeks, more than $600 million was stolen from DeFi across over 10 different protocols. The recent ones included Rhea Finance witnessing an $18.4 million exploit tied to a slippage flaw.
Secondly, CoW Swap faced a front-end attack, and Drift Protocol faced a $285 million drain. Additionally, Zerion faced a $100K loss from the ‘internal company hot wallets,’ and the list goes on.
Taken together, these highlight how illicit actors are expanding their operational footprint in and around crypto.
Final Summary
- Within 46 minutes, KelpDAO was quick to pause all activity to avoid further damage.
- Multiple DeFi protocols paused activities on their platform regardless of facing any major losses.