The decentralized finance sector has suffered another tragic hack, this time Kelp DAO losing an estimated $294 million in a massive exploit.
In a matter of minutes, attackers took advantage of the vulnerability to mint nearly 116,500 rsETH tokens worth almost $293.72 million that had no underlying assets. According to early reports, the attacker quickly utilized minted tokens via various protocols, converting and deploying funds for maximum profit.
This breach has raised further alarms about the stamina level of cross-chain infrastructure with emerging DeFi integrations merely getting larger and complex today. It adds to a series of major DeFi hacks, highlighting the deep security holes still plaguing even long-standing platforms.
Contents
Exploiter Mints Tokens Then Uses Them To Lend And Sell For ETH
After creating rsETH without authorization, the attacker then intentionally looped value out of it. So after the 116,500 rsETH was deposited into lending platforms (primarily Aave) to generate collateral used to borrow ETH.
At the same time, a smaller proportion of the new tokens were sold directly to the open market for ETH. This dual strategy, borrowing against collateral in addition to immediately selling tokens acquired, allowed the adversary to increase profits while decreasing chances of immediate detection.
Using these simultaneous tricks, the attacker got away with about 106,466 ETH (approximately $250 million dollars). This episode shows how attackers are leveraging the composability of DeFi to take advantage of interrelated protocols together, thus amplifying the impact of a single vulnerability.
This precise execution speaks to an extremely advanced understanding of DeFi mechanics and indicates a growing trend in the complexity of modern-day crypto exploits.
A Closer Look At The LayerZero Infrastructure
Attention has rapidly turned towards the underlying architecture that enabled the exploit: a cross-chain messaging protocol called LayerZero. Initial analyses indicate that the weakness may be due to how validators are set up in the protocol.
Crypto commentator Steven pointed out that this problem could be rooted in a 1/1 validator set Decentralized Verifier Network (DVN). In such an arrangement, to evade security, one devious or faulty validator could sign malicious transactions for permissionlessly bypassing. If true, this would be a significant design flaw, creating a central point of failure in a decentralised system. But the implications extend further,- negatively affecting not only Kelp DAO, but other projects that use similar underlying cross-chain architecture.
the issue with the @KelpDAO 280m$ hack was that it was just secured by just 1/1 validator set (DVN) on @LayerZero_Core . Which means one faulty transaction from a validator is all that's needed.
my belief is that the root cause was possibly that the LZ validator on Unichain was… pic.twitter.com/DzA7vEuXhL
— Steven Enamakel (@senamakel) April 18, 2026
Such a development has reignited discussions regarding efficiency versus security in blockchain architecture, including appeals for increased rigor in both validation protocols and redundancy mechanisms.
Fallout Of The Market Leading To Liquidation & Heavy Losses
The aftermath of the exploit quickly spread out across the wider crypto space with related tokens and leveraged bets getting hit too. Importantly, the price of 2 to $1.40 after a breach announcement was made. Such a sharp decline resulted in leveraged traders facing partial liquidation.
The most notable case involved a whale long on HyperLiquid experiencing a $2.88 million liquidation. The position has now incurred an unrealized loss of more than $750,000 but the trader remains in the position. In total, the whale has racked up even larger losses today, close to $28.98 million cumulative losses – showing how one major exploit can have a roll on effect for those in and around the market.
Such events highlight just how interconnected the crypto ecosystem can be, as one exploit can cause a domino effect felt far and wide across many platforms and assets.
Kelp DAO Responds, Contracts Suspended While Investigating
Kelp DAO was quick to recognize the breach and put the emergency protocols in place immediately after. With the detection of suspicious cross-chain activity including rsETH, the team was able to quickly pause all affected contracts on Ethereum mainnet, as well as a number of Layer 2 networks. Kelp DAO even made an official statement regarding its collaboration with LayerZero, as well as Unichain, auditors and top security experts on the matter
Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.
We are working with @LayerZero_Core, @unichain, our auditors and top security experts on RCA.
We will keep you…
— Kelp (@KelpDAO) April 18, 2026
The crew has committed to a whole root cause analysis (RCA) to decide precisely how the exploit happened as well as be aware of measures to prevent future events. Users were advised to obtain updates only from official communications channels as the incident investigation continues. While such a prompt response may limit additional damage, restoring user confidence will require thorough explanations of the mistakes made, greater accountability, and the fleshing-out of a plan to re-establish trust.
DeFi Security Concerns Intensify After Consecutive Major Hacks
Hot on the heels of Drift losing $285m in assets 17 days ago due to another major DeFi exploit comes the Kelp DAO hack. The recent nature of these events has only amplified concerns about systemic weaknesses in the decentralized finance ecosystem.
These breaches collectively paint a troubling picture: DeFi platforms are still fraught with critical security shortfalls, even amid stunning innovation and growth. Cross-Chain Interactions Increase Attack Surface The increasing complexity of protocols, especially those operating across chains, seems to expand the attack surface that opponents have access to.
And for both developers and investors, the message is clear: security must be a top priority. The industry is changing and requires more thorough audits, better infrastructure design, and tougher defenses against exploitation.
The case of Kelp DAO illustrates clearly that DeFi brings unprecedented new opportunities, but also serious risks. The broader crypto community is tuning in, hoping we emerge stronger; empowered to rebuild the pillars of DeFi on a more resilient foundation.
Disclosure: This is not trading or investment advice. Always do your research before buying any cryptocurrency or investing in any services.
Follow us on Twitter @nulltxnews to stay updated with the latest Crypto, NFT, AI, Cybersecurity, Distributed Computing, and Metaverse news!
