Hackers exploit Kelp DAO rsETH bridge, $292M stolen

[fullfitlarry]

https://x.com/coinbureau/status/2045632430993031226

So it's just a normal day for us crypto enthusiast to here this kind of exploits happening again and again?

As reported a hacker drained 116,500 rsETH (18% of supply) from Kelp DAO’s LayerZero-powered bridge, a whopping $292M.

When this projects to learn from this hacks that has been going on? Why they can't security hardened and tie loose ends before being exploited by cyber criminals?

[TastyChillySauce00]

The people who took the hit are WETH suppliers in AAVE. They got bad debt and the rsETH used as collateral is basically useless token from exploit that have no backing.
This doesn't look good at all for all these exploits that have happened, maybe people will become a lot more hesitant to put their money into lending platform and they've always been the one targeted with the bad debt attack.

Even when your smart contract is solid, other project can put a $292 million hole and make thousands of people lose their lifesaving.
I can't imagine being the victim, losing all their money unable to withdraw for doing literally nothing but just supplying it in a platform that is supposedly the best of the best with hundreds of audit.

[FinneysTrueVision]

It was less than three weeks ago that Drift Protocol was hacked for $280 million. That seemed like an exceptionally large amount, but the losses from the rsETH exploit are even greater.

The people who took the hit are WETH suppliers in AAVE. They got bad debt and the rsETH used as collateral is basically useless token from exploit that have no backing.
This doesn't look good at all for all these exploits that have happened, maybe people will become a lot more hesitant to put their money into lending platform and they've always been the one targeted with the bad debt attack.

Even when your smart contract is solid, other project can put a $292 million hole and make thousands of people lose their lifesaving.
I can't imagine being the victim, losing all their money unable to withdraw for doing literally nothing but just supplying it in a platform that is supposedly the best of the best with hundreds of audit.

rsETH still has 84% backing. Aave also has the Umbrella fund that can cover some of the losses. Due to the magnitude of the bad debt, it might not be enough, which unfortunately means that those who staked their tokens in the WETH Umbrella pool might lose everything.

Bad debt could still continue to grow. One side effect is that people are rushing to withdraw funds from lending markets as a precaution, which is causing borrow rates to increase rapidly. USDT is at 100% utilization on Aave with borrow costs around 15%.

[sergiorus]

Finally LayerZero having its own "Wormhole" moment.... Took long enough. Those protocols aren't safe. Imho only Chainlink's CCIP is worth implementing at the moment but what do i know...

[asriloni]

People have to learn a lesson to never hand their money to the defi platform. Just in matter of weeks two defi gets hacked for almost 600m. Meanwhile, the developers behind it being so clueless about how to recover their money cuz they don't have any left.

Beside that i'm also fully blaming the bridge providers caused this has always becomet the weakest point used by hack to mint the fake token. This is why there should always be a centralized actor who gated this.

If it's not, defi will never ever safe to use.

[dansus021]

Oh my god this is just first Quarter 1 of 2026 we already see hacked from drift protocol and now kepl dao when this massive hack actualy end?

rsETH does this mean this is wrapped version of ETH? Back couple month ago I just watched a movie called the big short and this wrapped version of eth and things getting out of control just like in the movie. I mean staked eth version can be staked again is insane in my opinion you basically staking paper with label Eth on it.

I just opened their twitter and lead into some user post https://x.com/realtommybibi/status/2045602411390337267 AAVE, Euler and Compund might affected aswell

[FinneysTrueVision]

Oh my god this is just first Quarter 1 of 2026 we already see hacked from drift protocol and now kepl dao when this massive hack actualy end?

rsETH does this mean this is wrapped version of ETH? Back couple month ago I just watched a movie called the big short and this wrapped version of eth and things getting out of control just like in the movie. I mean staked eth version can be staked again is insane in my opinion you basically staking paper with label Eth on it.

I just opened their twitter and lead into some user post https://x.com/realtommybibi/status/2045602411390337267 AAVE, Euler and Compund might affected aswell

Allowing people to borrow tens of millions against a staked version of a staked ETH wrapper is just a disaster waiting to happen. That is multiple layers of risk stacked on top of one another. There is risk in the underlying staked ETH being stolen or slashed. There’s risk in the liquid staking token backing the restaked token being stolen, having a bug, or depegging. Then there are risks with bridges and DeFi protocols where the LRT is being used. Anybody could have seen this was a house of cards, yet Aave didn’t have stricter limits in place.

[TastyChillySauce00]

rsETH still has 84% backing. Aave also has the Umbrella fund that can cover some of the losses. Due to the magnitude of the bad debt, it might not be enough, which unfortunately means that those who staked their tokens in the WETH Umbrella pool might lose everything.

Bad debt could still continue to grow. One side effect is that people are rushing to withdraw funds from lending markets as a precaution, which is causing borrow rates to increase rapidly. USDT is at 100% utilization on Aave with borrow costs around 15%.

Yep, it's either Kelp Dao want to take the hit and put haircut towards their staker and reduce rsETH redeem value to contain the phantom rsETH released from their bridge or the umbrella fund will cover losses.
Feels really bad for those who staked umbrella token hoping to get additional yield which is not even that much additional yield and losing their money instead. But it is what it is and the main purpose umbrella fund is created in the first place.

[etk80]

LayerZero V2 allows projects to choose their own DVN (verifier) configuration. Kelp chose the most dangerous possible setup — a 1-of-1, meaning a single node controlled by a single entity could authorize any mint.

Finally LayerZero having its own "Wormhole" moment.... Took long enough. Those protocols aren't safe. Imho only Chainlink's CCIP is worth implementing at the moment but what do i know...

[sergiorus]

LayerZero V2 allows projects to choose their own DVN (verifier) configuration. Kelp chose the most dangerous possible setup — a 1-of-1, meaning a single node controlled by a single entity could authorize any mint.

Finally LayerZero having its own "Wormhole" moment.... Took long enough. Those protocols aren't safe. Imho only Chainlink's CCIP is worth implementing at the moment but what do i know...

thanks for the heads up. didn't know that.
i guess i'm still sour about the whole airdrop thing but also i'm biased about Chainlink.

[Kavelj22]

People have to learn a lesson to never hand their money to the defi platform. Just in matter of weeks two defi gets hacked for almost 600m. Meanwhile, the developers behind it being so clueless about how to recover their money cuz they don't have any left.

In most of the similar cases happened in the past, I have never heard about devs or audit entity being accountable by any mean. If devs are running the protocol by their own responsability, they should be held accountable. And if there is an audit, the two parts should be interrogated and required to find a solution by somehow method. Managing assets wasn't that easy like we see today in the crypto field.

In the other hand, investors and regular users deserve the big loss because either they don't care doing researches before using such protocils with real money, or not interested in news about previous successful hacks.

[jossiel]

Another project that has a service of lending/borrowing.

It has happened before and will continue happen again and again.

These platforms if not exploited and abused, they'd be hacked by whoever can see the loophole within their system.

[OmegaStarScream]

Arbitrum just froze 71 million dollars linked to this hack[1]. Not sure how was it done, given that (and correct me if I'm wrong) this is the first time they have ever done despite having multiple hacks in the past...

Another reason as to why you should never fully trust an L2, or any chain really aside from Bitcoin which has proven its decentralization.

[1] https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit

[Oshosondy]

Arbitrum just froze 71 million dollars linked to this hack[1]. Not sure how was it done, given that (and correct me if I'm wrong) this is the first time they have ever done despite having multiple hacks in the past...

Another reason as to why you should never fully trust an L2, or any chain really aside from Bitcoin which has proven its decentralization.

[1] https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit

I was about to post this and I saw that you have posted it. I have used Arbitrum in the past, but later I used optimism and back to the ethereum blockchain after the Fusaka upgrade that makes the ethereum transaction fee to be very cheap. This news makes me know that these other layers can not be trusted but I do not see their usefulness anymore after the Fusaka upgrade.

[fullfitlarry]

Arbitrum just froze 71 million dollars linked to this hack[1]. Not sure how was it done, given that (and correct me if I'm wrong) this is the first time they have ever done despite having multiple hacks in the past...

Another reason as to why you should never fully trust an L2, or any chain really aside from Bitcoin which has proven its decentralization.

[1] https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit

And this is the latest news:

Arkham identified the KelpDAO attacker relocating $175.41M to new Ethereum addresses after Arbitrum’s Security Council froze $71M linked to the $292M exploit.

https://cryptobriefing.com/kelpdao-hacker-moves-175m-after-arbitrum-freezes-71m-linked-to-292m-exploit/

So now it's on a moved, also I'm not sure how the hackers are going to mixed or laundered this hacks to make it invisible. This is the biggest so far for this year and so everyone are excited to catch the hackers here.

[OmegaStarScream]

https://cryptobriefing.com/kelpdao-hacker-moves-175m-after-arbitrum-freezes-71m-linked-to-292m-exploit/

So now it's on a moved, also I'm not sure how the hackers are going to mixed or laundered this hacks to make it invisible. This is the biggest so far for this year and so everyone are excited to catch the hackers here.

Not sure about making it invisible but the more they split it around multiple coins and chains, the harder it will be to trace down.

Three things I would imagine they're going to use here:

- Thorchain because it's fully decentralized.
- Some non-KYC instant exchanges because they're faster, and support XMR which Thorchain does not (for now).
- Tornado Cash.

[sergiorus]

https://cryptobriefing.com/kelpdao-hacker-moves-175m-after-arbitrum-freezes-71m-linked-to-292m-exploit/

So now it's on a moved, also I'm not sure how the hackers are going to mixed or laundered this hacks to make it invisible. This is the biggest so far for this year and so everyone are excited to catch the hackers here.

Not sure about making it invisible but the more they split it around multiple coins and chains, the harder it will be to trace down.

Three things I would imagine they're going to use here:

- Thorchain because it's fully decentralized.
- Some non-KYC instant exchanges because they're faster, and support XMR which Thorchain does not (for now).
- Tornado Cash.

Since we're talking 9 figures, only Tornado Cash is a viable option. The rest is not liquid enough.
Of course there'll still be no way of cashing out those funds legally, but at least the direct traces would be gone.

Honestly they should have accepted the whatever deal they were offered. I think 5-10% white hat tip is rather common - with the amount stolen, that would be enough to make your bloodline wealthy for many generations.

[OmegaStarScream]

Since we're talking 9 figures, only Tornado Cash is a viable option. The rest is not liquid enough.
Of course there'll still be no way of cashing out those funds legally, but at least the direct traces would be gone.

They don't necessarily have to do all of the amount at once and by looking at the data here, I would argue that it's happening right now as we are speaking:

https://thorchain.net/dashboard

Compare today's volume with the rest of the month. I doubt it's a coincidence.

[sergiorus]

Since we're talking 9 figures, only Tornado Cash is a viable option. The rest is not liquid enough.
Of course there'll still be no way of cashing out those funds legally, but at least the direct traces would be gone.

They don't necessarily have to do all of the amount at once and by looking at the data here, I would argue that it's happening right now as we are speaking:

https://thorchain.net/dashboard

Compare today's volume with the rest of the month. I doubt it's a coincidence.

Could be. This is one of the big transfers today.

Peanuts compared to the total amount they have stolen (if it IS them, of course).

I wonder if they have emptied the BTC pool already? The explorer seems to be updating these stats only once a day?

BUT if it is indeed the scammer, their bitcoin wallet is known and traceable now as well: https://www.blockchain.com/explorer/addresses/BTC/bc1qwwtxvzsrqrt70qgrefgajre96wvxfhmrtry7fh
Of course in such a case it would be one of the many bitcoin wallets but all of them would be just as traceable.

[ene1980]

Arbitrum just froze 71 million dollars linked to this hack[1]. Not sure how was it done, given that (and correct me if I'm wrong) this is the first time they have ever done despite having multiple hacks in the past...

Another reason as to why you should never fully trust an L2, or any chain really aside from Bitcoin which has proven its decentralization.

This is the first time Arbitrum froze assets because of the hack but this is nothing new, as ETH, Tron, BNB chain has done it in the past and Arbitrum claims to have a Security Council to make this decision and Tron/Eth has done the same in the past but never heard about a security coucil overlooking these things, but they found a new term for centralization  .

The truth is you cannot trust L2 and BTCitcoin is the only decentralized coin.