\n
<\/p>\n
\n\t\t\t\t\t\t\t\t\tThis became the biggest security incident of 2026 in terms of USD value. \t\t\t\t\t\t\t\t<\/p>\n<\/p><\/div>\n
Multiple on-chain security companies and industry sleuths reported late on Saturday that the liquid restaking protocol KelpDAO had fallen victim to a major hack in which the perpetrators drained nearly $300 million.<\/p>\n
The team behind the project confirmed the incident hours later, and added that they have partnered with LayerZero, Unichain, their auditors, and \u2018top security experts\u2019 to resolve the issue.<\/p>\n
Cyvers was among the security resources that detected the breach in its initial phase and later provided a more detailed explanation of what happened. According to a post they shared with CryptoPotato<\/em>, the attacker exploited the protocol\u2019s bridge contract and siphoned roughly $293.7 million from its liquid restaking token, rsETH.<\/p>\n The bad actor moved quickly after taking hold of the funds and swapped them into ETH. They spread them across Ethereum and Arbitrum, with the on-chain activity showing that the attacker split the funds into two batches: $178 million on the former and $72 million on the layer-2 chain.<\/p>\n The stolen rsETH was deposited into lending protocols like Aave V3, Compound V3, and Euler. By using the illicitly obtained funds, they borrowed substantial amounts of WETH, creating more than $236 million in debt.<\/p>\n Cyvers explained that an attacker can end up creating unbacked rsETH and then use it to borrow real assets like ETH, which is \u201cexactly how this kind of exploit blows up so fast.\u201d The security experts added that this immediately became a cross-protocol contagion event, not just a single protocol exploit. Such assets that are deeply integrated across lending, vaults, and liquidity protocols are particularly susceptible to similar incidents, and one failure \u201cdoes not stay contained.\u201d<\/p>\n \u201cIt spreads instantly, creating bad debt, forcing market freezes, and impacting multiple platforms at once.\u201d<\/p>\n<\/blockquote>\n Aave V3 froze rsETH markets, SparkLend froze exposure, while Fluid, Compound, Euler, and others moved to contain risk. Cyvers said that at least 9 protocols were affected.<\/p>\n The project\u2019s official X account confirmed the breach after they had \u201cidentified suspicious cross-chain activity involving rsETH.\u201d They said they paused those contracts across the mainnet and several layer-2s as the investigation continued.<\/p>\n Although they are working with LayerZero, Unichain, auditors, and other security experts on the matter, there hasn\u2019t been another update in the past 10 hours as of press time on what\u2019s next and what users might expect.<\/p>\n Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.<\/p>\n We are working with @LayerZero_Core<\/a>, @unichain<\/a>, our auditors and top security experts on RCA.<\/p>\n We will keep you\u2026<\/p>\n \u2014 Kelp (@KelpDAO) April 18, 2026<\/a><\/p>\n<\/blockquote>\n KelpDAO\u2019s hack became the largest in the industry so far in 2026, surpassing the previous \u2018record-holder\u2019, Drift Protocol, whose exploit<\/a> was for $280 million.<\/p>\n LIMITED OFFER for CryptoPotato readers at Bybit: Use this link<\/a> to register and open a $500 FREE position on any coin!<\/b><\/p>\n<\/div>\n<\/div>\n <\/p><\/div>\n\n
You may also like:<\/h3>\n
KelpDAO Talks<\/h2>\n
\n
\nBinance Free $600 (CryptoPotato Exclusive): Use this link<\/a> to register a new account and receive $600 exclusive welcome offer on Binance<\/b> (full details<\/a>).<\/p>\n