Key Takeaways
- • Kelp DAO suffered a $292–$294 million exploit on its rsETH bridge, the largest single-protocol hack of 2026, surpassing the previous record held by Drift Protocol's exploit.
- • The attack exploited an "OApp peer-trust bug" on the source chain, allowing attackers to drain rsETH across Ethereum and Arbitrum; the attacker funded initial wallets through Tornado Cash to obscure transaction trails.
- • The stolen rsETH was deployed as collateral on Aave's lending protocol to mint unbacked debt, creating cascading contagion across the DeFi ecosystem and impacting the WETH pool on Aave.
- • Aave froze rsETH markets on its v3 and v4 protocols as a precaution; AAVE token declined 10–18% amid broader market panic, and over $5.4 billion was withdrawn from Aave as users feared systemic risk.
- • Industry observers, including Bankless co-founder Ryan Sean Adams, cite AI-enabled attack automation as a critical factor reducing the skill barrier and cost of executing sophisticated exploits, marking a structural shift in DeFi security dynamics.
Summary
On April 19, 2026, blockchain security experts detected nearly $294 million in suspicious activity flowing out of Kelp DAO, an Ethereum-based liquid restaking protocol. The exploit targeted the rsETH adapter—a mechanism allowing users to deposit liquid staking tokens such as stETH and cbETH in exchange for rsETH, which can then be used across multiple DeFi platforms while maintaining staking rewards. The attack was first flagged by blockchain analyst ZachXBT and confirmed by security firm Cyvers, establishing this as the largest single-protocol hack of 2026.
Security forensics identified the vulnerability as an "OApp peer-trust bug" stemming from a key compromise on the source chain. The attacker executed a coordinated sweep across Ethereum and Arbitrum, draining $293.7 million in rsETH from the protocol's bridge. Initial funding for the attack wallets was routed through Tornado Cash, a coin-mixer service, to obscure transaction origins and complicate tracing efforts. Rather than immediately liquidating the stolen assets, the attacker deployed a sophisticated multi-step strategy: the stolen rsETH was deposited as collateral on Aave, the world's largest DeFi lending protocol, to mint unbacked debt. This created a cascading vulnerability, as the rsETH collateral had been hollowed out and was therefore worthless, leaving Aave's WETH reserves effectively impaired.
The market response was immediate and severe. Aave's founder and CEO Stani Kulechov announced the freezing of rsETH markets on Aave v3 and v4 protocols as a protective measure, explicitly stating that Aave's own contracts remained unexploited. Despite these assurances, contagion fears spread rapidly. Aave's native AAVE token declined between 10% and 18% in 24-hour trading, and user confidence deteriorated sharply—over $5.4 billion in deposits were withdrawn from Aave as institutional and retail participants rushed to de-risk exposure to the broader DeFi ecosystem.
Industry participants identified AI-driven attack automation as a structural amplifier of the exploit's scale and sophistication. Bankless co-founder Ryan Sean Adams characterized the current environment as a record-pace hacking period, attributing the acceleration to AI serving as a "dark superpower" that has materially lowered both the technical skill barrier and the cost of executing attacks. As one observer noted, "the defenders have to automate their responses or get liquidated by the first machine that finds a hole." This observation underscores a critical risk shift in DeFi: the asymmetry between human-speed defense and machine-speed offense has widened considerably, suggesting that protocol security models designed for conventional attack vectors may be obsolete. The Kelp DAO hack exemplifies DeFi composability's fatal flaw—the concentration of a single asset (rsETH) across dozens of interconnected protocols creates systemic risk that amplifies losses across the entire ecosystem rather than containing them.
Security forensics identified the vulnerability as an "OApp peer-trust bug" stemming from a key compromise on the source chain. The attacker executed a coordinated sweep across Ethereum and Arbitrum, draining $293.7 million in rsETH from the protocol's bridge. Initial funding for the attack wallets was routed through Tornado Cash, a coin-mixer service, to obscure transaction origins and complicate tracing efforts. Rather than immediately liquidating the stolen assets, the attacker deployed a sophisticated multi-step strategy: the stolen rsETH was deposited as collateral on Aave, the world's largest DeFi lending protocol, to mint unbacked debt. This created a cascading vulnerability, as the rsETH collateral had been hollowed out and was therefore worthless, leaving Aave's WETH reserves effectively impaired.
The market response was immediate and severe. Aave's founder and CEO Stani Kulechov announced the freezing of rsETH markets on Aave v3 and v4 protocols as a protective measure, explicitly stating that Aave's own contracts remained unexploited. Despite these assurances, contagion fears spread rapidly. Aave's native AAVE token declined between 10% and 18% in 24-hour trading, and user confidence deteriorated sharply—over $5.4 billion in deposits were withdrawn from Aave as institutional and retail participants rushed to de-risk exposure to the broader DeFi ecosystem.
Industry participants identified AI-driven attack automation as a structural amplifier of the exploit's scale and sophistication. Bankless co-founder Ryan Sean Adams characterized the current environment as a record-pace hacking period, attributing the acceleration to AI serving as a "dark superpower" that has materially lowered both the technical skill barrier and the cost of executing attacks. As one observer noted, "the defenders have to automate their responses or get liquidated by the first machine that finds a hole." This observation underscores a critical risk shift in DeFi: the asymmetry between human-speed defense and machine-speed offense has widened considerably, suggesting that protocol security models designed for conventional attack vectors may be obsolete. The Kelp DAO hack exemplifies DeFi composability's fatal flaw—the concentration of a single asset (rsETH) across dozens of interconnected protocols creates systemic risk that amplifies losses across the entire ecosystem rather than containing them.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.