$292 Million in 46 Minutes: How a Forged Cross-Chain Message Toppled KelpDAO and Sent Shockwaves Through DeFi's Lending Stack

A single compromised LayerZero DVN validator allowed an attacker to forge cross-chain messages, mint 116,500 unbacked rsETH tokens, and trigger the largest DeFi exploit of 2026 — with cascading bad debt that may permanently redefine how lending protocols treat liquid restaking tokens as collateral.

Executive Summary

• $292 million in rsETH drained in a single LayerZero lzReceive exploit on April 18, 2026, representing approximately 18% of rsETH's total circulating supply of 630,000 tokens and making this the single largest DeFi security incident year-to-date.

• The attacker immediately weaponized stolen rsETH as collateral across Aave V3/V4, Compound V3, and Euler, extracting over $236 million in WETH and creating an estimated $177–$200 million in irrecoverable bad debt across DeFi lending markets.

• Systemic contagion froze rsETH markets at Aave, SparkLend, Fluid, Lido Finance, Ethena, and Upshift — exposing the fragility of multi-chain liquid restaking infrastructure where a single bridge reserve backs tokens on more than 20 networks simultaneously.

• The exploit surfaced a latent architectural risk in LayerZero's DVN (Decentralized Verifier Network) model: a 1/1 validator configuration means one compromised or malicious signer can authorize fraudulent cross-chain messages at scale with no countervailing check.

• Near-term recovery hinges on Aave's Umbrella safety module (holding ~$50M, a fraction of total bad debt), a likely governance vote on WETH supplier haircuts, and KelpDAO's ability to recapitalize — all while the restaked ETH narrative faces an existential credibility test heading into Q2 2026.

Background & Market Context

KelpDAO launched in late 2023 as a liquid restaking protocol built on top of EigenLayer, allowing users to deposit LSTs (liquid staking tokens) such as stETH, rETH, and cbETH and receive rsETH — a restaked ETH derivative that accrues EigenLayer point rewards while remaining liquid and usable as DeFi collateral. By April 2026, KelpDAO had grown to become the second-largest protocol in the EigenLayer ecosystem by total value locked, with approximately $1.07 billion in TVL. rsETH had achieved broad integration across more than 20 Layer 2 networks including Arbitrum, Base, Linea, Blast, Mantle, and Scroll via LayerZero's OFT (Omnichain Fungible Token) standard.

The choice of LayerZero's OFT architecture was, until April 18, considered a best-in-class solution for omnichain token deployment. OFT allows a canonical token to exist on a home chain (Ethereum mainnet) while wrapped representations are minted and burned on destination chains using LayerZero's cross-chain messaging infrastructure. Critically, the protocol's DVN (Decentralized Verifier Network) system is responsible for verifying that messages are legitimate before they are accepted. In theory, a well-configured DVN with multiple independent validators should make forging cross-chain messages computationally infeasible and economically irrational.

The macro backdrop entering April 2026 was one of cautious optimism: ETH had recovered to approximately $2,500, EigenLayer had continued to grow its operator ecosystem, and rsETH had become one of the most widely integrated collateral assets in the DeFi lending stack. Aave's V4 upgrade, rolled out in late 2025, had introduced E-Mode configurations specifically designed to maximize capital efficiency for "highly correlated" ETH-adjacent assets like rsETH, wstETH, and rETH. This E-Mode design — which lowered liquidation thresholds and raised loan-to-value ratios based on the assumption of tight price correlation — would later prove to be a double-edged sword when rsETH's peg to ETH catastrophically collapsed overnight.

The DeFi sector had already absorbed one major shock in Q1 2026: the $285 million Drift Protocol exploit on April 1, which had rattled confidence in Solana-based perpetual DEX infrastructure. The KelpDAO incident, occurring just 17 days later, more than eclipsed Drift in scale and complexity — and, unlike Drift, its contagion vectors spread synchronously across the entire Ethereum DeFi lending ecosystem.

Key Developments

April 18, 17:35 UTC — Initial Exploit Transaction Confirmed The attacker — operating through six wallets pre-funded hours earlier via Tornado Cash — executed a targeted call to the lzReceive function on LayerZero's EndpointV2 contract on Ethereum mainnet. The forged cross-chain message convinced Kelp's OFT bridge contract that a valid inbound transfer had originated from another chain, triggering the unauthorized release and minting of 116,500 rsETH directly to attacker-controlled addresses. The root cause was subsequently identified by on-chain security researchers as an OApp peer-trust vulnerability — Kelp's bridge peer contract had been compromised on the source chain, and the DVN configuration used a dangerous 1/1 validator set, meaning a single validator could sign and authorize cross-chain messages without any redundancy or challenge period.

April 18, 17:40–17:55 UTC — Collateral Deployment Across Lending Protocols With remarkable operational speed, the attacker immediately deposited stolen rsETH into Aave V3 and V4 (Ethereum mainnet and Arbitrum), as well as Compound V3 and Euler, using the fraudulent tokens as collateral. Leveraging Aave's E-Mode configuration for ETH-correlated assets — which assigned rsETH a high loan-to-value ratio based on its assumed peg to ETH — the attacker borrowed over $236 million in WETH across the three markets. One attacker address alone was later identified holding approximately $120 million in ETH on Aave. The borrowed WETH was consolidated and routed to wallets that reportedly held approximately 74,000 ETH post-exploit.

April 18, 18:00 UTC — rsETH Peg Breaks, Market Chaos Ensues As stolen rsETH flooded secondary markets and news of the exploit propagated across Telegram and X, rsETH's price collapsed from approximately $2,500 toward effectively $0 relative to its "fair value." The token's volume spiked more than 100,000% within minutes. On-chain investigator ZachXBT flagged the breach in a public Telegram post, identifying the six attacker wallets and confirming initial funding from Tornado Cash. Because the collateral backing the attacker's Aave positions was now worthless, the borrowed WETH positions became effectively unliquidatable through normal mechanisms — Aave's liquidation bots could not profitably close positions collateralized by a collapsed token, creating instant bad debt.

April 18, 18:21 UTC — KelpDAO Emergency Pause Activated (46 Minutes After Attack) Kelp DAO's emergency pauser multisig activated a protocol-wide freeze on all core contracts, 46 minutes after the initial drain. This halted any further minting, burning, or bridging of rsETH. Two subsequent attacker attempts — at 18:26 UTC and 18:28 UTC — both reverted against the freeze; each carried a LayerZero packet attempting to drain an additional ~40,000 rsETH worth roughly $100 million. The emergency pause therefore prevented what could have been a $400 million total loss, though the $292 million already extracted could not be recovered.

April 18–19 — Cascading Protocol Freezes and AAVE Market Reaction Within hours of the initial exploit, Aave froze rsETH markets on both V3 and V4. Aave founder Stani Kulechov publicly confirmed that Aave's smart contracts were not compromised and that the attack originated entirely from rsETH's bridge infrastructure. SparkLend, Fluid, Lido Finance (pausing earnETH deposits which carry rsETH exposure), Ethena (halting LayerZero bridges as a precautionary measure despite no direct rsETH exposure), and Upshift all suspended rsETH-related markets or operations. The AAVE token declined approximately 10–14% as markets priced in bad debt exposure and potential WETH supplier haircuts. Aave's Umbrella safety module — which replaced the legacy Safety Module in late 2025 and holds approximately $50 million in aWETH — emerged as the designated backstop, though it covered only a fraction of the estimated $177–$200 million in bad debt.

Technical Analysis

The LayerZero DVN Architecture and Its Failure Mode

LayerZero's cross-chain messaging infrastructure relies on a configurable security model in which each OApp (Omnichain Application) operator can specify their own DVN — a set of independent validators responsible for verifying that a message sent from Chain A has actually been committed on Chain A before it is accepted and acted upon on Chain B. The critical parameter is the number of validators required to reach consensus. LayerZero recommends multi-validator configurations with at least 2/3 or 3/5 quorums for high-value applications. KelpDAO's rsETH OFT bridge, however, appears to have been configured with a 1/1 DVN validator set — a single required signer — which is the minimum possible security threshold.

In a 1/1 configuration, compromise or impersonation of the single validator yields unconditional trust: any message signed by that validator will be accepted as legitimate by the destination chain. Security researcher Steven (X: @_0xMacro) was among the first to publicly identify this configuration, noting: "A 1/1 DVN means a single devious or faulty validator can sign malicious transactions and permissionlessly bypass all security." Post-exploit analysis further characterized the root cause as an "OApp peer-trust bug" — the attacker did not merely compromise a validator key in isolation, but appears to have compromised or cloned a legitimately deployed Kelp DAO peer contract on the source chain, allowing the generation of LayerZero messages that appeared structurally valid to the destination chain's verification logic.

The lzReceive Attack Path

The technical execution flow centered on lzReceive, the function that LayerZero's EndpointV2 contract calls on destination chains when it receives a verified cross-chain message. Under normal operation, lzReceive is only callable by the LayerZero endpoint and only after DVN verification is complete. In the KelpDAO case, the attacker's forged message passed DVN verification (because the DVN configuration was compromised or was 1/1), meaning the LayerZero endpoint legitimately called lzReceive on KelpDAO's OFT receiver contract. The OFT contract interpreted this as a valid instruction to release rsETH from the bridge's reserve — and it was technically correct to do so by the protocol's own rules. The vulnerability was not in KelpDAO's OFT logic itself, but in the upstream trust assumptions baked into the DVN configuration.

E-Mode: A Capital Efficiency Feature Weaponized

A secondary but critically important technical failure was Aave's E-Mode treatment of rsETH. E-Mode (Efficiency Mode) allows assets with high price correlation — such as ETH, stETH, wstETH, and rsETH — to use elevated LTV (loan-to-value) ratios and lower liquidation thresholds, on the assumption that they will not decouple significantly in price. This is sound logic under normal conditions and significantly improves capital efficiency for legitimate users. However, E-Mode contains an implicit systemic assumption: that the collateral assets are legitimately correlated. When rsETH's value dropped to near-zero due to being unbacked rather than due to a market price movement, E-Mode's design created a pathological state in which the lending market continued to treat rsETH as valid correlated collateral — preventing the normal liquidation mechanism from triggering in a timely fashion. By the time rsETH markets were frozen, the positions were already irredeemably insolvent.

The 20-Chain Backing Problem

The architectural choice to use a single bridge reserve on Ethereum mainnet to back rsETH representations across 20+ networks created a single point of failure with asymmetric blast radius. Once the mainnet reserve was drained, every wrapped rsETH token on every L2 simultaneously became fully unbacked — even tokens held by users who had never interacted with Aave, KelpDAO's bridge contract, or LayerZero directly. This is a structural property of the hub-and-spoke OFT model: the spokes derive 100% of their value from the hub's integrity.

sequenceDiagram
    participant ATK as Attacker (6 Wallets)
    participant TC as Tornado Cash
    participant DVN as LayerZero DVN (1/1 Validator)
    participant EP as EndpointV2 Contract
    participant OFT as KelpDAO OFT Bridge (Mainnet)
    participant AAVE as Aave V3/V4 (ETH + Arbitrum)
    participant COMP as Compound V3 / Euler
    participant L2 as rsETH on 20+ L2s

    ATK->>TC: Pre-fund 6 wallets (hours before)
    ATK->>DVN: Compromise / exploit 1/1 validator key
    DVN->>EP: Sign forged cross-chain message as valid
    EP->>OFT: Call lzReceive() — "valid" inbound transfer from Chain X
    OFT->>ATK: Release 116,500 rsETH (~$292M)
    Note over OFT,L2: All 20+ L2 rsETH representations now unbacked
    ATK->>AAVE: Deposit stolen rsETH as E-Mode collateral
    ATK->>COMP: Deposit stolen rsETH as collateral
    AAVE->>ATK: Release $236M+ WETH (borrowed against rsETH)
    COMP->>ATK: Release additional WETH/ETH
    Note over AAVE: rsETH collapses → bad debt ~$177-200M
    AAVE->>AAVE: Freeze rsETH markets (V3 + V4)
    Note over OFT: Emergency pause at T+46 min (18:21 UTC)
    ATK-->>EP: 2 follow-up attempts (18:26, 18:28 UTC) — REVERTED

On-Chain & Market Data

The market data tells a story of both speed and contagion severity. The 46-minute window between initial exploit and emergency pause is simultaneously impressively fast for a decentralized protocol and devastatingly slow relative to the speed of on-chain transactions — the attacker needed only minutes to complete fund extraction and collateral deployment. The AAVE token's 10–14% decline reflects rational market pricing of bad debt that exceeds the Umbrella module's $50 million backstop by a factor of 3–4x, with the shortfall of approximately $127–$150 million ultimately requiring either governance intervention, protocol reserve deployment, or — most painfully — WETH supplier haircuts that would socialize losses across innocent depositors.

The rsETH volume spike of 100,000%+ underscores how liquidity events following exploits are not random: arbitrageurs, liquidation bots, and panicked holders simultaneously attempt to exit the same door. The fact that rsETH representations on 20+ Layer 2 networks became simultaneously unbacked creates a long-tail redemption problem — users holding rsETH on Arbitrum, Base, Linea, or Scroll cannot even bridge back to mainnet through the now-paused LayerZero OFT bridge to assess their position, effectively stranding capital of uncertain value across the multichain ecosystem for an indefinite period.

Competitive Landscape

LayerZero vs. Alternative Cross-Chain Messaging

The KelpDAO exploit has reignited fierce debate about LayerZero's security model versus alternatives. Wormhole uses a Guardian network of 19 validators in a 13/19 threshold configuration for its core messages, providing substantially higher Byzantine fault tolerance. Axelar relies on a permissioned validator set coordinated through Cosmos SDK consensus, with economic security backed by staked AXL. Chainlink CCIP uses a Risk Management Network (RMN) with an independent monitoring layer that can curse (halt) suspicious messages before they execute. Crucially, none of these alternatives offer LayerZero's fully permissionless DVN customization model — which is also its greatest strength when configured correctly. The irony of the KelpDAO incident is that LayerZero's architecture would have been perfectly secure with a 2/3 DVN quorum; the failure was a configuration choice, not an intrinsic protocol flaw.

KelpDAO vs. Competing Liquid Restaking Protocols

In the EigenLayer ecosystem, KelpDAO's primary competitors include EtherFi (the largest liquid restaking protocol by TVL at over $3B), Renzo Protocol, and Puffer Finance. EtherFi's eETH uses a fundamentally different cross-chain strategy: it deploys canonical bridges with conservative validator sets and does not use OFT's hub-and-spoke reserve model for most chains. Renzo's ezETH similarly maintains more conservative cross-chain configurations. Puffer Finance, smaller but technically cautious, had not yet deployed omnichain representations via OFT at the time of the KelpDAO incident. The incident is likely to accelerate differentiation in the liquid restaking sector, with protocols that took conservative bridging approaches gaining significant credibility.

The rsETH Collateral Deprecation Problem

For lending protocols, the immediate competitive question is whether rsETH's status as "blue-chip collateral" — a designation it shared with wstETH and rETH in Aave's E-Mode configuration — can ever be restored. Morpho Blue had significantly lower rsETH exposure than Aave due to its curator-driven market structure, which had imposed tighter supply caps on rsETH markets. Euler v2's modular vault system similarly limited cross-contamination. Compound V3 and mainstream Aave V3/V4 bore the brunt of the damage. This suggests that more conservative, curator-governed lending architectures may gain market share from the current crisis, as the monolithic pool model that made Aave dominant also made it the single largest victim of collateral contagion.

2026 Hack Landscape Context

The KelpDAO incident is the second nine-figure DeFi exploit within 17 days in 2026, following Drift Protocol's $285 million loss on April 1. This pace — over $577 million lost in under three weeks — far exceeds the monthly loss rates seen in 2024 and early 2025, and suggests either a step-function increase in sophisticated attacker activity or a structural vulnerability in the new generation of restaking and omnichain infrastructure that became widely deployed in 2024–2025.

Stakeholder Analysis

rsETH Token Holders

The most directly harmed party is the approximately 630,000 rsETH circulating supply holders across 20+ networks. The 116,500 stolen tokens represent an 18% dilution of the supply's underlying collateral claim. For holders on L2 networks whose wrapped rsETH cannot be bridged back to mainnet due to the emergency pause, the situation is particularly acute: they hold tokens of indeterminate value with no clear timeline for redemption. KelpDAO has not yet announced a compensation or recapitalization plan, leaving these holders in a state of uncertainty.

Aave WETH Suppliers

Aave's WETH depositors face the risk of a "haircut" — a forced reduction in their withdrawal rights to cover bad debt. The Umbrella module's $50M in aWETH will be automatically slashed to partially offset the estimated $177–$200M deficit, but the $127–$150M shortfall must be addressed through governance. WETH suppliers who can withdraw are rationally incentivized to do so immediately, potentially creating a bank-run dynamic on the WETH pool even if Aave's solvency is not genuinely threatened. The AAVE token's decline reflects this governance uncertainty, as any governance vote to socialize losses is likely to be contentious.

Aave Governance and AAVE Token Holders

Aave DAO faces a governance crisis that requires rapid decision-making: should bad debt be absorbed by the Umbrella module (socializing costs among aWETH stakers), funded through protocol reserves, or addressed through a combination of approaches? The precedent set by this governance decision will have lasting implications for how lending protocols respond to black-swan collateral events. AAVE token holders bear the ultimate risk of protocol insolvency, though Aave's size and diversification make existential failure extremely unlikely.

LayerZero Protocol

LayerZero Labs faces significant reputational damage even if, technically, the root cause was KelpDAO's configuration choice. The broader market will not easily distinguish between "LayerZero was misconfigured" and "LayerZero was exploited." LayerZero's business development pipeline — particularly for high-value financial applications — may slow as potential integrators demand security audits of DVN configurations before launch. The company must proactively publish best-practice configuration guidelines and potentially advocate for mandatory minimum DVN thresholds in its protocol.

DeFi Regulators and Institutional Observers

The KelpDAO incident arrives at a sensitive moment in DeFi's institutional development. Several TradFi-adjacent funds and institutions had begun allocating to liquid restaking tokens as yield-bearing ETH alternatives in 2025–2026. A $292 million loss in under an hour, with cascading bad debt across the ecosystem's largest lending protocol, provides fresh ammunition for those arguing that DeFi's composability creates systemic risk that is structurally difficult to audit or contain. Regulatory scrutiny of restaking infrastructure in the EU (under MiCA's evolving technical standards) and US (under the SEC's renewed DeFi Task Force activity) is likely to intensify.

EigenLayer

EigenLayer is a second-order victim: its liquid restaking ecosystem's flagship protocol has suffered a devastating blow. EigenLayer's TVL and operator commitments are not directly affected, but the reputational damage to the restaking narrative — and the potential reduction in ETH deposits from users who chose liquid restaking specifically for DeFi composability — creates headwinds for the platform's growth trajectory.

Risk Assessment

1. Aave WETH Supplier Bank Run — If WETH pool utilization spikes and withdrawal queues form, a self-fulfilling liquidity crisis could develop even if Aave is ultimately solvent. The rational response for any WETH supplier is to withdraw, creating coordination failure. Severity: High | Probability: Medium. Mitigation requires Aave governance to move rapidly on a credible bad debt resolution plan, ideally within 48–72 hours of the incident.

2. rsETH Permanent Depegging on L2 Networks — The 20+ L2 networks holding wrapped rsETH face a scenario where bridge restoration takes weeks or months, and the underlying reserve on mainnet has been permanently impaired. If KelpDAO cannot recapitalize at 1:1 backing — which requires either recovering stolen funds (extremely unlikely given attacker sophistication and Tornado Cash pre-funding) or raising new capital — L2 rsETH holders may ultimately recover cents on the dollar. Severity: High | Probability: Medium-High.

3. LayerZero DVN Contagion Scan — Security researchers and black hats alike are now incentivized to audit every OFT deployment using LayerZero for 1/1 DVN misconfigurations. If additional protocols are found to have similarly weak validator configurations, a wave of follow-on exploits is plausible in the days or weeks following this incident. Severity: Very High | Probability: Medium. LayerZero Labs and the security community must conduct and publish comprehensive DVN configuration audits of all high-value OFT deployments immediately.

4. Restaking Narrative Collapse and TVL Outflows — The broader liquid restaking sector (EtherFi, Renzo, Puffer, and others) may experience significant TVL outflows as risk-averse users withdraw from any protocol using cross-chain infrastructure. If this leads to large-scale ETH unstaking, it could create meaningful sell pressure on ETH and stETH in the near term. Severity: Medium-High | Probability: Medium. The risk is highest for smaller liquid restaking protocols that have not yet demonstrated comparable security architecture to EtherFi's more conservative bridging approach.

5. Regulatory Acceleration Against DeFi Composability — The incident provides regulators with a high-profile example of how interconnected DeFi protocols amplify losses — KelpDAO's bridge failure propagated to Aave, which propagated to WETH suppliers, which propagated to AAVE governance, which created uncertainty for all AAVE stakers. The systemic nature of the contagion may accelerate mandatory risk disclosure requirements, collateral approval frameworks, or bridge security standards under MiCA or SEC guidance. Severity: Medium | Probability: High over 6-12 month horizon.

Investment & Strategic Implications

For DeFi protocols, the incident should catalyze an immediate audit of all cross-chain security configurations — not just LayerZero DVN settings, but the full stack of bridge assumptions embedded in any collateral onboarding decision. Aave, Compound, Morpho, and their governance bodies should implement independent bridge security requirements as a precondition for accepting any cross-chain token as collateral: minimum DVN quorum thresholds, mandatory time-locks on large cross-chain mints, and circuit breakers that pause minting if supply grows anomalously within a short window. The KelpDAO exploit was effectively presaged by the mechanics of Aave's collateral onboarding: no one appears to have stress-tested the scenario in which rsETH's bridge integrity failed catastrophically.

For funds and institutional allocators, the incident reinforces a principle that has been theoretically understood but practically underweighted: composability risk is correlated risk. Holding rsETH as a yield-bearing ETH substitute while simultaneously holding Aave governance tokens or supplying WETH to Aave means that a single attack can impair multiple portfolio positions simultaneously. Institutional-grade DeFi portfolio construction should model these second-order dependencies explicitly, stress-testing what happens to each position if a major collateral asset goes to zero overnight. Funds that had diversified away from both rsETH and Aave WETH positions before April 18 will significantly outperform on a risk-adjusted basis.

For builders and infrastructure developers, the deeper strategic implication is that the permissionless configurability that makes LayerZero powerful is also a systemic liability when deployed by protocols whose teams do not have the security expertise to understand the consequences of their DVN choices. The industry needs either mandatory DVN minimums enforced at the protocol layer (which LayerZero could implement as a configurable hard floor for high-value applications) or a robust ecosystem of third-party auditors who specialize specifically in cross-chain security configuration — not just smart contract code review. The next generation of cross-chain infrastructure must treat security configuration as a first-class engineering concern, not a deployment checkbox.

Outlook: 30 / 180 / 365 Days

• 30 days: Aave governance will pass an emergency proposal to resolve bad debt through a combination of Umbrella slashing and protocol reserve deployment; KelpDAO will publish a post-mortem confirming the 1/1 DVN root cause and announce either a recapitalization plan or a structured wind-down of L2 rsETH representations. AAVE token will partially recover if the governance resolution is credible, potentially rebounding 50% of its post-exploit decline. LayerZero Labs will publish mandatory DVN security guidelines and offer free configuration audits to all high-TVL OFT deployments. The ETH market will absorb the 74,000 ETH held by the attacker as a sustained overhang — expect subdued ETH performance in the near term.

• 180 days: The liquid restaking sector will undergo meaningful consolidation, with smaller protocols that cannot demonstrate equivalent security architecture losing TVL to EtherFi, which will emerge as the sector's credibility benchmark. LayerZero will introduce protocol-level minimum DVN requirements for any OFT deployment above a configurable TVL threshold. Aave will implement a formalized "bridge security scorecard" for collateral assets, potentially retiring E-Mode treatment for any cross-chain token that cannot meet minimum bridging standards. Regulatory guidance specifically addressing restaking infrastructure risks will be proposed in at least one major jurisdiction.

• 365 days: The KelpDAO incident will be remembered as the catalyst that forced DeFi's lending stack to explicitly price cross-chain infrastructure risk — similar to how the 2022 Euler Finance exploit ($197M, later recovered) accelerated flash loan security research. Cross-chain collateral will not disappear, but the onboarding standards, supply caps, and DVN requirements for any bridge-backed token seeking Aave or Compound listing will be substantially more rigorous. The restaking narrative will survive but be bifurcated: native restaking (direct EigenLayer deposits without a liquid token layer) will gain share, while liquid restaking tokens that rely on cross-chain bridges will require independent security ratings to maintain institutional legitimacy.

References

1. 2026's biggest crypto exploit: $292 million gets drained from Kelp DAO with wrapped ether stranded across 20 chains — CoinDesk

2. Kelp DAO hit by $292M bridge hack draining rsETH reserves, Aave freezes affected markets — CryptoBriefing

3. The Biggest DeFi Hack of 2026: $293 Million Gone in 46 Minutes — CoinDoo

4. Kelp DAO Hack: $292M Drained from rsETH Bridge — SpazioCrypto

5. Aave WETH Suppliers Urged to Withdraw After KelpDAO rsETH Exploit — Yahoo Finance

6. KelpDAO rsETH Exploit Creates $290M Bad Debt on Aave — Startup Fortune

7. KelpDAO Exploiter Borrows $236M in WETH — Blockchain.news

8. Every DeFi Trader Is Watching This Kelp $292M DAO Exploit — Yellow.com

9. ZachXBT Flags $280M+ KelpDAO Exploit Hitting Ethereum DeFi Lending Markets — Bitcoin.com News

10. KelpDAO exploit causes AAVE ETH pool to utilization — CryptoBriefing

11. Kelp DAO Suffers $292M Exploit Through LayerZero Bridge Vulnerability — MoneyCheck

12. AAVE Price Drops After DeFi Exploit Triggers Liquidation Cascade — Edaface News

13. Kelp DAO Exploited for $294M Due to Cross Chain Vulnerability in DeFi Security — NullTX

14. Hackers target DeFi protocol Kelp DAO in massive $300m exploit — DL News

15. KelpDAO Exploit Impacts Aave Lending Market — Intellectia.ai