Loading article…
The $292 million Kelp DAO exploit highlights a surge in DeFi hacks in 2026, as security experts point to social engineering and cross-chain vulnerabilities.
The decentralized finance (DeFi) sector faced a significant security crisis in April 2026, headlined by a $292 million exploit of the Kelp DAO protocol [2]. The incident, which involved the theft of approximately 116,500 rsETH, triggered a broader liquidity disruption across the crypto lending market and contributed to a record-breaking month for industry losses [1].
Key takeaways
The Kelp DAO attack originated from a compromise of the protocol’s cross-chain infrastructure. According to a post-mortem report from LayerZero, whose messaging protocol supported the bridge, the incident began on March 6 when a developer was targeted by a social engineering campaign that resulted in the theft of session keys [2]. Security firms Mandiant and CrowdStrike attributed the subsequent April 18 drain to the North Korea-linked threat actor TraderTraitor [2].
The fallout from the theft was immediate and widespread. The attacker deposited a large portion of the stolen rsETH into the Aave lending platform as collateral to borrow wrapped Ether, creating $190 million in bad debt [1]. This triggered a massive wave of withdrawals, causing Aave’s total value locked to plummet [1]. In response, a relief effort led by Aave CEO Stani Kulechov, known as “DeFi United,” raised approximately $303 million in ETH to backstop the bad debt [2]. By mid-May, Kelp DAO began the process of restoring operations, reopening rsETH bridging and withdrawals after a five-week recovery period [1].
Experts suggest that the Kelp DAO incident is part of a recurring pattern of failures in DeFi architecture, particularly regarding cross-chain bridges and privileged access controls [2]. Raz Niv, CTO of Blockaid, noted that attackers are methodically probing trust assumptions in complex infrastructure, such as multisig thresholds and proxy upgrades [2]. Furthermore, there is growing concern that artificial intelligence is lowering the barrier for exploit discovery, allowing attackers to automate reconnaissance and identify vulnerabilities in older or unverified smart contracts more efficiently [2].
Coverage is mostly measured — 60 of 75 reports stay neutral.
Every Monday — the token unlocks, Fed dates & catalysts set to move crypto and markets this week. So you’re never blindsided.
Free · 3-min read · one-click unsubscribe
AI-assisted synthesis by the TrendWatcher Editorial Desk · sourced from 2 outlets · Jun 1, 2026 · How we report
A DAO is a decentralized autonomous organization that uses blockchain-based software and smart contracts to manage organizational processes like voting and finance.
The legal status of DAOs is generally unclear and varies by jurisdiction, though some states like Wyoming have introduced legislation to recognize them as legal entities.
Because DAO code is difficult to alter once live, fixing security holes often requires writing new code and reaching an agreement to migrate all funds to a new system.
The 2026 surge in exploits has highlighted a shift in the threat landscape, with North Korea-linked actors accounting for 76% of global crypto hack losses through April [2]. Security investigators emphasize that while code audits are essential, they do not protect against sophisticated social engineering campaigns that target human processes [2]. As the industry moves forward, experts suggest that cybersecurity must be treated as a "full-stack problem," requiring a combination of real-time public-private coordination and the deployment of AI-assisted defensive tools to keep pace with increasingly aggressive adversaries [2].
Voting power is typically coordinated through governance tokens or NFTs, where holding a larger quantity of tokens often translates to greater influence over organizational decisions.