Kelp DAO Hit for $292M in 2026's Biggest DeFi Exploit — Nine Protocols Freeze

DeFi's worst hack of 2026 landed on Sunday evening. An attacker exploited a critical flaw in Kelp DAO's LayerZero-powered cross-chain bridge, draining 116,500 rsETH — worth approximately $292 million at the time — and stranding wrapped ether across 20 separate blockchain networks. The contagion spread immediately, forcing nine protocols to freeze markets within hours.

The exploit surpasses the Drift protocol attack earlier in the year as 2026's largest single DeFi incident. On-chain investigator ZachXBT flagged the anomalous minting activity within minutes of the attack beginning, but the damage was already done.

Disclaimer: This article is for informational purposes only and does not constitute financial advice. Always do your own research before making investment decisions.

How the Exploit Worked

The attack exploited a single-signer vulnerability inside Kelp DAO's LayerZero bridge implementation. LayerZero's cross-chain messaging layer is designed to relay instructions between blockchains — but it depends on the receiving contract to validate the authenticity of those instructions robustly.

In Kelp's case, the bridge's trust model relied on a single authorised signer to approve cross-chain transactions. The attacker constructed a spoofed message that impersonated a valid cross-chain instruction, tricking the bridge into believing an authorised mint request had arrived from a connected network. That single forged message was enough to release 116,500 rsETH to an attacker-controlled address.

The vulnerability was not in LayerZero's core protocol itself but in Kelp's integration — a reminder that bridge security is only as strong as the application layer built on top of the underlying messaging infrastructure.

The Cascade: Nine Protocols Freeze

The real damage magnified rapidly through DeFi's interconnected lending markets. Attackers quickly moved portions of the stolen rsETH into Aave V3 and V4 as collateral — borrowing against assets that were, in effect, unbacked.

Aave froze rsETH markets on both V3 and V4 within hours, but not before its total value locked had plunged approximately $6.6 billion. Aave's AAVE governance token fell 16% on the news as markets priced in potential bad debt exposure. SparkLend and Fluid followed with their own rsETH market freezes, and six additional protocols enacted defensive pauses.

Across 20 chains, legitimate rsETH holders found their assets effectively stranded — bridges had been halted to prevent further manipulation, leaving users unable to move or redeem their positions.

What rsETH Is — and Why It Matters

rsETH is Kelp DAO's liquid restaking token, representing staked ETH that has been re-deposited into EigenLayer restaking contracts. Liquid restaking tokens (LRTs) like rsETH have grown substantially in 2026 as users seek to compound staking yields via EigenLayer's actively validated services (AVSs).

The sector's rapid growth — Kelp held over $1.6 billion in TVL before the exploit — has outpaced the security infrastructure around it. Cross-chain bridges are a persistent weak point: they hold large pools of assets while relying on off-chain validation logic that is difficult to audit comprehensively.

Approximately 18% of rsETH's entire circulating supply was drained in the attack, a concentration that explains why the contagion reached so far. Protocols with rsETH collateral positions were all immediately at risk.

Industry Response

Kelp DAO's core team confirmed the attack on social media within two hours, suspending all bridge operations and urging users to revoke any open approvals to the bridge contract. The team said it was working with security firms to trace funds and engage with authorities.

Security researcher Chris Blec noted on X that the single-signer model used in Kelp's bridge had been flagged in an audit from 2025 but was never remediated — pointing to a pattern in DeFi where audit findings are acknowledged but not prioritised for fixes before launch or upgrade.

Aave governance quickly assembled an emergency council session to assess bad debt exposure and determine whether emergency reserve funds would be needed to protect depositors.

What This Means for DeFi Security

The Kelp exploit arrives as DeFi's total value locked has recovered toward all-time highs in 2026 following the sector's bear market contraction. That recovery has attracted users back into higher-risk protocols without a proportional upgrade in the security standards governing them.

Cross-chain bridges remain the sector's most dangerous attack surface. Since 2022, bridge exploits have accounted for over 60% of all DeFi losses by value — a statistic that has stubbornly refused to improve despite years of audits, bug bounties, and architectural redesigns.

The move toward multi-party computation (MPC) and threshold signature schemes for bridge validators — rather than single-signer setups — is widely understood to be the right direction. But retrofitting existing bridges is expensive and requires governance approval, creating windows of vulnerability that sophisticated attackers are increasingly willing to exploit.

What to Watch

Bad debt resolution: Aave governance will vote on whether to use its Safety Module to cover any shortfall from frozen rsETH collateral positions.
rsETH redemption: Kelp DAO must determine whether stolen rsETH can be invalidated and legitimate holders made whole — a complex process that may involve EigenLayer coordination.
Regulatory reaction: The scale of the hack is likely to accelerate discussions in Congress around DeFi-specific disclosure and security requirements under the CLARITY Act framework.
Bridge sector: Expect immediate security reviews across LayerZero-integrated protocols and likely TVL outflows from LRT platforms as users reassess risk.