Loading article…
Kelp DAO lost $293 million in a cross-chain bridge exploit, marking 2026's largest DeFi hack. Aave froze rsETH markets as industry losses exceed $605M.
The cryptocurrency sector has lost over $605 million to cyberattacks in the first 20 days of April 2026, headlined by a $293 million breach at the liquid restaking protocol Kelp DAO [2]. The exploit, which targeted a cross-chain communication system, represents the largest decentralized finance (DeFi) theft of the year and has triggered a wave of emergency freezes across the lending ecosystem [2].
| At a glance | |
|---|---|
| Kelp DAO Loss | $293 Million |
| Total April Losses | $605 Million |
| rsETH Stolen | 116,500 Tokens |
| Aave Native Token Move | -20% |
On Sunday, April 19, an attacker utilized a privacy tool to fund a wallet before exploiting a vulnerability in the LayerZero EndpointV2 contract [2]. By tricking the system into accepting a fraudulent instruction, the hacker forced the Kelp bridge to release 116,500 rsETH, accounting for approximately 18% of the token's total circulating supply of 630,000 [2]. Kelp DAO responded by pausing its contracts across the mainnet and several Layer 2 networks to prevent further unauthorized outflows [2].
The incident created immediate contagion risks for major lending platforms that accept rsETH as collateral. Aave, the largest DeFi lending protocol with over $20 billion in locked assets, moved to freeze its rsETH markets on both V3 and V4 platforms to prevent new borrowing against the compromised asset [2]. While Aave confirmed its own smart contracts remained secure, the platform’s native token dropped 20% during Asian trading hours as market participants reacted to the potential for bad debt [2].
The Kelp DAO breach follows a series of high-profile security failures that have defined the month. Prior to this incident, the Drift Protocol exploit on April 1 resulted in $285 million in losses, while smaller attacks on platforms like Grinex and Rhea Finance have contributed to at least 12 distinct security events since the start of the month [2]. These attacks have utilized a range of methods, from domain hijacking and social engineering to the manipulation of oracle pricing data [2].
While the broader DeFi market grapples with these security challenges, institutional-grade infrastructure continues to see high activity. Binance recently launched an institutional loan program offering up to 4x leverage, targeting high-frequency traders who require rapid liquidity [1]. Data from May 22—when Bitcoin reached an all-time high of $112,000—showed Binance recording an average deposit of 7 BTC per user, significantly higher than the 1.23 BTC average at OKX or 0.8 BTC at Coinbase, signaling a concentration of large-volume participants on the platform [1].
The frequency and scale of these exploits suggest that the industry’s reliance on interconnected cross-chain bridges has created a systemic vulnerability that remains difficult to contain. Whether platforms can successfully offset accumulated bad debt without further eroding investor confidence remains the primary open question for the DeFi sector.
Coverage is mostly measured — 175 of 184 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 2 outlets · Sep 9, 2026 · How we report
Crypto Lending protocols may attempt to mitigate price manipulation by halting block production to roll back unauthorized transactions, as seen in the August 30, 2026, Tectonic exploit. However, this method cannot recover assets that have already been moved off the network through bridges.
As of September 2026, Crypto Lending platforms accept a variety of assets including Bitcoin, Ethereum, Solana, XRP, and tokenized gold products like PAX Gold and Tether Gold. Some platforms allow borrowers to use these assets as collateral to obtain loans in USD or USDC without selling their holdings.
Crypto Lending platforms typically do not use traditional credit checks for loan approval because the crypto collateral itself acts as the underwriting mechanism. As of September 2026, platforms like CoinRabbit and Arch Lending process loans based on the value of the deposited digital assets.
Rehypothecation in Crypto Lending refers to the practice of a platform reusing or lending out client collateral to other parties. Platforms such as CoinRabbit and Arch Lending maintain no-rehypothecation policies to provide clients with greater certainty that their deposited assets remain reserved.