# Kelp DAO Hack Drains $293 Million in Largest 2026 DeFi Exploit

**Published:** 2026-09-09T08:03:04.398Z  
**Topic:** Crypto Lending  
**Sentiment:** neutral  
**Publisher:** TrendWatcher — https://www.trendwatcher.in/article/0f89f204-959a-40b0-8e55-4d8fbc9376d7

Kelp DAO lost $293 million in a cross-chain bridge exploit, marking 2026's largest DeFi hack. Aave froze rsETH markets as industry losses exceed $605M.

The cryptocurrency sector has lost over $605 million to cyberattacks in the first 20 days of April 2026, headlined by a $293 million breach at the liquid restaking protocol Kelp DAO [2]. The exploit, which targeted a cross-chain communication system, represents the largest decentralized finance (DeFi) theft of the year and has triggered a wave of emergency freezes across the lending ecosystem [2].

| At a glance | |
|---|---|
| Kelp DAO Loss | $293 Million |
| Total April Losses | $605 Million |
| rsETH Stolen | 116,500 Tokens |
| Aave Native Token Move | -20% |

## Anatomy of the Breach
On Sunday, April 19, an attacker utilized a privacy tool to fund a wallet before exploiting a vulnerability in the LayerZero EndpointV2 contract [2]. By tricking the system into accepting a fraudulent instruction, the hacker forced the Kelp bridge to release 116,500 rsETH, accounting for approximately 18% of the token's total circulating supply of 630,000 [2]. Kelp DAO responded by pausing its contracts across the mainnet and several Layer 2 networks to prevent further unauthorized outflows [2].

The incident created immediate contagion risks for major lending platforms that accept rsETH as collateral. Aave, the largest DeFi lending protocol with over $20 billion in locked assets, moved to freeze its rsETH markets on both V3 and V4 platforms to prevent new borrowing against the compromised asset [2]. While Aave confirmed its own smart contracts remained secure, the platform’s native token dropped 20% during Asian trading hours as market participants reacted to the potential for bad debt [2].

## A Volatile Security Environment
The Kelp DAO breach follows a series of high-profile security failures that have defined the month. Prior to this incident, the Drift Protocol exploit on April 1 resulted in $285 million in losses, while smaller attacks on platforms like Grinex and Rhea Finance have contributed to at least 12 distinct security events since the start of the month [2]. These attacks have utilized a range of methods, from domain hijacking and social engineering to the manipulation of oracle pricing data [2].

While the broader DeFi market grapples with these security challenges, institutional-grade infrastructure continues to see high activity. Binance recently launched an institutional loan program offering up to 4x leverage, targeting high-frequency traders who require rapid liquidity [1]. Data from May 22—when Bitcoin reached an all-time high of $112,000—showed Binance recording an average deposit of 7 BTC per user, significantly higher than the 1.23 BTC average at OKX or 0.8 BTC at Coinbase, signaling a concentration of large-volume participants on the platform [1].

## What to watch
*   **Bad Debt Resolution:** Monitor Aave’s official disclosures regarding the potential deficit caused by rsETH borrows that occurred following the exploit [2].
*   **Security Audits:** Watch for updates from Kelp DAO and its security partners regarding the Root Cause Analysis (RCA) of the LayerZero bridge vulnerability [2].
*   **Market Contagion:** Track the liquidity and price stability of rsETH across secondary markets as the protocol remains paused [2].

The frequency and scale of these exploits suggest that the industry’s reliance on interconnected cross-chain bridges has created a systemic vulnerability that remains difficult to contain. Whether platforms can successfully offset accumulated bad debt without further eroding investor confidence remains the primary open question for the DeFi sector.

## Sources
1. Benzinga.com — [Binance Launches Institutional Loans With Up to 4x Leverage, Zero Interest Offers](https://www.benzinga.com/content/46259366/binance-launches-institutional-loans-with-up-to-4x-leverage-zero-interest-offers)
2. TheStreet · via AOL — [Major DeFi hack becomes the largest of 2026 yet](https://www.aol.com/articles/major-defi-hack-becomes-largest-113334915.html)

---
Cite as: TrendWatcher, "Kelp DAO Hack Drains $293 Million in Largest 2026 DeFi Exploit", https://www.trendwatcher.in/article/0f89f204-959a-40b0-8e55-4d8fbc9376d7