Kelp DAO hacket for 293 millioner dollar

The liquid restaking protocol Kelp DAO fell victim to the largest DeFi hack of 2026. The attacker stole 116,500 $rsETH worth $293 million through a vulnerability in the OFT contract powered by LayerZero.Instead of a simple swap, the hacker instantly deposited the stolen tokens into Aave (as well as Compound V3 and Euler) and borrowed clean WETH/ETH worth over $236 million.

This triggered a chain reaction. The creation of massive bad debt (estimated at $177–280 million) in Aave pools caused whales to panic. According to Lookonchain, over $5.4 billion in assets were withdrawn from the protocol in ETH. WETH pool utilization hit 100%, Aave’s TVL plummeted by more than $6 billion (from $26+ billion to ~$22 billion), and the $AAVE token crashed 20% in 24 hours.

How the Hack Unfolded

The attack took place at 17:35 UTC via a forged cross-chain message in LayerZero (the lzReceive function). The attacker crafted a fake instruction from a peer contract (presumably on Unichain), causing Kelp DAO’s OFT adapter to mint 116,500 rsETH (18% of the entire circulating supply) straight from escrow without any real backing.

This was not a classic smart-contract bug in Kelp itself, but a bridge-level exploit using 1-of-1 DVN validation.

The hacker never sold the rsETH on DEXes. Instead, he immediately used the tokens as collateral across multiple lending protocols and withdrew real ETH. Within just 46 minutes, Kelp DAO paused the contracts, two further attempts by the hacker (another ~$200 million) were successfully blocked.

Protocol Reactions

• Kelp DAO immediately paused all rsETH contracts on Ethereum mainnet and every L2 (Arbitrum, Base, Scroll, etc.). Official statement: “We are working with LayerZero, auditors, and security experts on root cause analysis.”
• Aave froze all rsETH markets on both V3 and V4. Founder Stani Kulechov stressed: “Aave itself was not hacked — the issue is with rsETH being used as collateral.”
• SparkLend, Fluid, and Upshift also introduced emergency restrictions.

Market Impact

• rsETH on L2s now faces serious depeg risk, the mainnet backing is compromised.
• Overall DeFi TVL dropped more than $10 billion due to widespread panic.
• This is already the second nine-figure hack in a month (after Drift Protocol’s $285M exploit). 2026 is on track to break all records for DeFi exploit volumes.

The hacker has begun laundering funds through Tornado Cash. Asset recovery currently looks unlikely, although Tron founder Justin Sun publicly offered to “have a conversation” with the attacker.