KelpDAO Hit by $293 Million Hack: What Happened
KelpDAO has been hit by a hack reportedly worth around $293 million, making it one of the largest DeFi exploits of 2026. The breach, which targeted the protocol’s cross-chain rsETH token infrastructure, has triggered downstream fallout across lending markets and prompted at least one major Bitcoin DeFi issuer to abandon its bridging provider entirely.
What to Know About the KelpDAO Hack
- Scale: LayerZero confirmed the April 18, 2026 exploit drained approximately $290 million from KelpDAO, isolated to the protocol’s rsETH configuration with no contagion to other LayerZero-connected assets.
- Developing story: The exact loss figure varies across sources, with early reports citing $293 million while primary statements point to roughly $290 million. KelpDAO itself has not published a postmortem, and some details, including final attribution, remain unconfirmed.
How the Exploit Unfolded
The attack was not a smart-contract bug. According to attackers compromised internal RPC nodes and launched a DDoS against external nodes, feeding false data into a 1-of-1 DVN verification path used by LayerZero’s infrastructure.
A forged inbound packet from Unichain to Ethereum released 116,500 rsETH from the Ethereum-side adapter without any corresponding source-side burn. That single fraudulent message drained the bulk of the adapter’s reserves.
After the exploit, only 40,373 rsETH remained confirmed in the adapter against 152,577 remote-chain claims, according to Aave’s incident report. The gap between backing and outstanding claims is the core of the downstream damage.
Chainalysis linked the attack to North Korea’s Lazarus Group, though that attribution remains preliminary rather than a publicly adjudicated conclusion. Law enforcement became involved after the exploit, and the Arbitrum Security Council froze a portion of downstream funds while coordinating with investigators.
Downstream Damage: Aave Faces Up to $230 Million in Bad Debt
Aave’s governance forum published two bad-debt scenarios stemming from the exploit. Under uniform loss socialization, the protocol faces an estimated $123.7 million in bad debt. If losses are isolated to L2 rsETH holders, the figure climbs to $230.1 million.
The scale of potential bad debt from a single bridge exploit underscores the concentration risk that cross-chain lending markets carry. Similar concerns around institutional crypto outflows have surfaced in other corners of the market this year, though the mechanisms differ.
Lombard Finance Moves $1 Billion Away From LayerZero
The most significant market reaction came from Lombard Finance, which announced it will migrate more than $1 billion in bitcoin-backed assets from LayerZero to Chainlink CCIP. The move represents a direct vote of no confidence in LayerZero’s bridge security following the KelpDAO breach.
This decision prioritizes the safety and security of all Lombard users and reflects our commitment to the security record we've maintained since day 1: 0 security incidents, and 100% uptime.
— Lombard (@Lombard_Finance) May 15, 2026
Source: @Lombard_Finance on X
Lombard’s migration is notable because it shifts a substantial portion of the Bitcoin DeFi ecosystem’s bridged assets to a competing infrastructure provider. For context, the broader crypto market was already under pressure, with Bitcoin trading at $78,093 and the Fear & Greed Index reading 31, firmly in “Fear” territory.
CoinMarketCap chart illustrating the price backdrop referenced in this article on KelpDAO.
The incident follows a period of mixed sentiment for digital assets. Spot Bitcoin ETFs recently recorded $290 million in outflows, and separate developments around BNB and Grayscale ETF filings have kept institutional attention fragmented across multiple narratives.
Why This Breach Matters
The KelpDAO exploit exposed a specific architectural weakness: a 1-of-1 verification path where a single compromised data feed could authorize a nine-figure withdrawal. The attack did not require breaking any smart contract logic, only the off-chain infrastructure feeding data to it.
The downstream chain of consequences, from unbacked rsETH claims to Aave bad-debt scenarios to Lombard’s billion-dollar migration, illustrates how a single bridge failure can cascade across otherwise unrelated protocols.
KelpDAO has yet to release a first-party postmortem or treasury impact statement. Until it does, the full scope of user losses and any potential recovery plan remain unclear.
