BAD MORNING: $293M Kelp DAO Hack: Biggest DeFi Exploit of 2026

What Happened
Kelp DAO's (@KelpDAO) rsETH bridge was exploited through LayerZero.
➡️ 116,500 rsETH drained (~$293M in minutes)
➡️ 18% of rsETH's total supply, gone
➡️ Main drain tx hit the lzReceive function on LayerZero's EndpointV2 contract
Main Drain Transaction
0x1ae232da212c45f35c1525f851e4c41d529bf18af862d9ce9fd40bf709db4222
Attack Flow
➡️ Attacker funded wallets via Tornado Cash
➡️ Spoofed a cross-chain message to trigger bridge release
➡️ Immediately started moving funds across DeFi
Main Attacker Wallets
0x5d3919f12bcc9e5f5b5274c1a3e3c2a6f2a257ccc
0xbb6a6006eb71a5c3c8c2c5d1c9d9c1c1d631c787
0x1f4c1c2e610f3b2c7f6e5a1c9b3d4a8db3adef
0xeba786c9517a4b3c2d1e6f5a9b8c7d6e68129b
0xcbb24a6b4daf3a2b1c4d5e6f7a8b9c0dae1455cc
0x8d11aeac74263b2a1c4e5f6a7b8c9d0e174c2d49
How The Attacker Used The Stolen rsETH
➡️ Deposited rsETH into Aave, Compound, Euler
➡️ Borrowed ETH/WETH against it
➡️ Swapped through Uniswap, Kyber and other DEXs
➡️ Opened and drained positions instantly
Estimated Flows
➡️ ~52,000+ ETH borrowed
➡️ ~16,000+ ETH borrowed
➡️ ~5,500+ ETH swapped
➡️ ~74,000 ETH consolidated
The Real Damage
The rsETH collateral is now frozen and broken. But the borrowed ETH is real and gone.
➡️ ~$280M+ bad debt left behind across lending protocols
Protocols Affected
➡️ Aave V3 - froze rsETH markets, facing ~$177M bad debt
➡️ Compound - exposure confirmed
➡️ Euler - exposure confirmed
@aave's Response
➡️ rsETH markets frozen on V3 and V4
➡️ Aave contracts NOT exploited, issue is rsETH itself
➡️ Umbrella safety module may slash aWETH stakers to cover the deficit
Domino Effect
➡️ SparkLend & Fluid froze rsETH markets
➡️ Lido paused earnETH deposits (stETH/wstETH safe)
➡️ Ethena paused LayerZero bridges as precaution
➡️ Upshift halted High Growth ETH & Kelp Gain vaults
Market Impact
➡️ $AAVE dropped 19% in Just 3 Days
➡️ $ETH dipped on DeFi contagion fears
➡️ rsETH peg at serious risk through the weekend
Retail Alert:
If you hold rsETH on any L2, check if your wrapped version is still backed. If you staked aWETH in Aave's Umbrella, expect possible slashing. Kelp's emergency pause blocked another $100M attempt, without it, losses would've hit $391M.
Bridge → DeFi → Bad Debt.
This is not over. Stay safe.