Kelp DAO Hack
REPORTED LOSS
$293M
What happened
On April 18, 2026, KelpDAO's rsETH bridge was attacked, resulting in the loss of 116,500 rsETH, valued at approximately $292 million at the time.
Case & protocol details
Classification
Borrowing and Lending / Bridge & Cross-Chain
Protocol Type
Exploit/Access control
Implementation language
Solidity
Official Website
kerneldao.com/kelp/defi/
Protocol Twitter/X
@KelpDAO
How it happened
LayerZero's incident report says attackers compromised RPC infrastructure relied on by the sole configured verifier, enabling an attestation for a forged cross-chain message. With no independent second verifier required, the destination contract accepted the message and unlocked rsETH without a corresponding source-chain deposit.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
- report Report x.com
- report Report x.com
- report Report x.com
- report LayerZero Labs KelpDAO Incident Report layerzero.network
- analysis Chainalysis: KelpDAO bridge exploit chainalysis.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
