On April 19, Kelp, a liquid staking protocol with a total value locked (TVL) of $1.57 billion, was exploited, losing $294 million in just a few minutes.
As expected, during this attack, KelpDAO Restaked ETH (RSETH) was largely compromised. According to Lookonchain, the illicit actor minted 116,500 RSETH, equivalent to $294 million, and sold it as collateral to borrow 106,467 ETH.
How did LayerZero act as a secret actor?
Although Kelp was able to interrupt the protocol in 46 minutes, the damage had already become irreversible.
In fact, further analysis of the exploit shed light on the fact that LayerZero, a cross-chain messaging layer, was acting as a bridge. By tricking LayerZero with valid instructions, the perpetrator was able to receive 116,500 rsETH from the Kelp Bridge.
As a result, LayerZero’s token ZRO also fell by over 22% in the past 24 hours as it changed hands at $1.52. This is a significant drop from trading above $2 just 2 days ago.
Additionally, the LayerZero team came forward to inform victims that they were in “active repair with the KelpDAO team.”
Needless to say, this attack had a multiple impact, as a whale holding a long ZRO position on Hyperliquid lost $2.88 million in liquidation. Although the whale is still in this position, it is already suffering a loss of 750,000 dollars, resulting in an overall loss of 428.98 million.
Widespread impact and reactions
Many in the crypto community are calling this the biggest DeFi hack of 2026, which is true considering rsETH exists in over 20 blockchains like Ethereum L2. Now, since users must have raced to immediately buy back or sell their rsETH, this could have put pressure on the remaining funds on Ethereum (ETH).
This liquidity crisis has led many protocols to freeze their platforms to avoid further damage. The Aave team froze Aave V3 and Aave V4, and its AAVE token saw a decline of over 20% in the last 24 hours as it traded at $92.06.
Simultaneously, whales holding AAVE also started dumping the token as soon as the incident came to light.
Although Ethena (ENA) has “no exposure to the rsETH exploit,” the team still suspended its LayerZero OFT bridges from the Ethereum mainnet out of “an abundance of caution.”
This resulted in a slight loss of over 3% for the token compared to others. Needless to say, Lido Finance is no exception as they followed the same approach.
Other attacks that shook the crypto world in 2026
In total, over the last 2 weeks, over $600 million has been stolen from DeFi across over 10 different protocols. Among the most recent, Rhea Finance witnessed an $18.4 million exploit related to a slipstream flaw.
Second, CoW Swap faced a frontal attack and Drift Protocol faced a loss of $285 million. Additionally, Zerion suffered a $100,000 loss due to “internal company hot wallets,” and the list goes on.
Taken together, these elements highlight how illicit actors are expanding their operational footprint in and around crypto.
Final summary
- In 46 minutes, KelpDAO was quick to suspend all activity to prevent further damage.
- Several DeFi protocols have suspended activities on their platform despite significant losses.
