The biggest DeFi exploit of 2026 didn’t start with a faulty smart contract. It started with two poisoned servers and a protocol that thought one verifier was enough.
On Saturday, April 19, attackers drained 116,500 rsETH – roughly $292 million – from KelpDAO’s cross-chain bridge in a surgical operation that lasted under 80 minutes. Within 24 hours, the blast radius had expanded to engulf Aave, DeFi’s largest lending protocol, wiping $6 billion from its total value locked and leaving nearly $200 million in bad debt on its books.
The fallout is still spreading. And the debate over who’s actually to blame is just getting started.
How the Attack Worked
This wasn’t a typical smart contract exploit. The attackers went after the infrastructure underneath the protocol.
KelpDAO’s bridge runs on LayerZero, a cross-chain messaging system that uses decentralized verifier networks (DVNs) to confirm transactions between blockchains. KelpDAO’s bridge operated with a single verifier – LayerZero’s own – meaning only one entity needed to sign off on cross-chain messages for them to execute.
The attackers, who LayerZero has attributed with preliminary confidence to North Korea’s Lazarus Group, compromised two remote procedure call (RPC) nodes that the verifier relied on. RPC nodes are the servers that let software read and write blockchain data. The attackers replaced the binary software on these nodes with malicious versions designed to feed fake transaction confirmations to LayerZero’s verifier while returning accurate data to every other system querying them.
That selective deception kept the attack invisible to monitoring tools.
But two compromised nodes weren’t enough on their own. The verifier also queried uncompromised external RPCs. So the attackers ran a distributed denial-of-service (DDoS) attack on those clean nodes between 10:20 a.m. and 11:40 a.m. Pacific Time on Saturday, forcing the verifier to fall back to the poisoned ones.
Once failover triggered, the compromised nodes told the verifier a legitimate cross-chain message had arrived. KelpDAO’s bridge released 116,500 rsETH. The malicious node software then self-destructed, wiping binaries and local logs.
The whole thing was over before anyone realized it had begun.
The Blame Game: LayerZero vs. KelpDAO
Within hours, a public war of words erupted between the two protocols.
LayerZero pointed the finger directly at KelpDAO’s security configuration. The liquid restaking protocol ran what’s known as a 1-of-1 verifier setup – meaning LayerZero Labs was the sole entity verifying messages to and from the rsETH bridge. LayerZero said its public integration checklist and direct communications had explicitly recommended a multi-verifier configuration with redundancy.
“KelpDAO chose to use a 1/1 DVN configuration,” LayerZero wrote in its post-mortem. “A properly hardened configuration would have required consensus across multiple independent DVNs, rendering this attack ineffective even in the event of any single DVN being compromised.”
KelpDAO fired back, claiming the compromised verifier was LayerZero’s own infrastructure and that the single-verifier setup was LayerZero’s onboarding default – not some rogue configuration KelpDAO picked against advice. Some security researchers have backed this claim, noting that LayerZero’s public documentation and deployment code promote single-source verification across major deployments.
LayerZero confirmed zero contagion to any other application on its protocol and announced it will no longer sign messages for any application running a 1-of-1 configuration, forcing a protocol-wide migration off single-verifier setups.
The Aave Meltdown
The exploit itself was bad. What it did to Aave was worse.
The attackers deposited the stolen rsETH tokens – now effectively unbacked – into Aave as collateral, then borrowed real ETH and wETH against them. Fake tokens in, real money out.
Aave froze rsETH markets on both V3 and V4 within hours. Founder Stani Kulechov affirmed the exploit was external and Aave’s contracts weren’t compromised. That freeze stopped the immediate bleeding.
But it triggered a bank-run dynamic that spread across the entire protocol.
Whales moved first. Justin Sun withdrew 65,584 ETH. MEXC exchange pulled its funds. Other large depositors followed. Within 24 hours, over $5.4 billion in ETH had left Aave, and the protocol’s TVL dropped from $26.4 billion to roughly $20 billion.
The ETH lending pool hit 100% utilization, meaning every deposited ETH had been borrowed and none remained for withdrawals. Then it spread to stablecoins. USDT and USDC pools also hit 100% utilization as the liquidity drain cascaded through every market on the platform.
Trapped depositors – unable to withdraw their USDT and USDC – started taking loans against their own locked funds at a loss just to extract any liquidity from the system.
“Some users decided to borrow against USDT/USDC and exit via other markets at a 10-25% loss,” explained analyst Duo Nine. “Basically you borrow GHO/DAI/USDe against your locked USDT/C.”
It wasn’t a trading strategy. It was desperation. Users were accepting 75 cents on the dollar to get any money out of a system that had frozen solid.
In total, roughly $300 million in secondary borrowing materialized in a single day. The AAVE token dropped more than 18%, and the protocol is carrying between $177 million and $236 million in bad debt.
Lazarus Group: $575 Million in 18 Days
LayerZero attributed the attack with preliminary confidence to North Korea’s Lazarus Group, specifically its TraderTraitor subunit. If confirmed, this means the same North Korean hacking operation has drained more than $575 million from DeFi in just 18 days.
On April 1, Lazarus hit Drift Protocol through social engineering of governance signers. On April 18, they pivoted to infrastructure-level attacks at KelpDAO. Two completely different attack vectors, both wildly successful.
The group is evolving its playbook faster than DeFi protocols are hardening their defenses.
The Ethereum Foundation’s Awkward Timing
In a coincidence that would be funny if it weren’t so painful, the Ethereum Foundation launched its $1 million Audit Subsidy Program on April 14 – four days before the KelpDAO hack. The program, which uses digital asset advisory firm Areta’s audit marketplace, gives Ethereum developers access to over 20 security firms including Blocksec, Certora, Hacken, Immunefi, and Quantstamp, covering up to 30% of audit costs.
The initiative addresses a real problem. Security audits are expensive, and many smaller teams ship code without them. But when a $292 million exploit succeeds through infrastructure compromise rather than a code vulnerability, $1 million in audit subsidies feels like bringing a garden hose to a warehouse fire.
The KelpDAO attack didn’t exploit a smart contract bug. It exploited an architectural decision that no code audit would have caught.
What This Means for Ethereum’s DeFi System
DeFi’s total value locked dropped by roughly $13 billion in the two days following the exploit. The “DeFi is dead” chorus on X.com is growing louder. And while DeFi is certainly not dead, the KelpDAO fallout has exposed structural risks that the system has been papering over.
Cross-chain bridges remain the weakest link. Single-verifier configurations are a ticking time bomb. And the composability that makes DeFi powerful – where one protocol’s tokens are used as collateral in another – also makes it a contagion machine when things go wrong.
For Ethereum specifically, the timing compounds an already rough stretch. ETH is trading around $2,286 as the broader market processes U.S.-Iran tensions alongside the DeFi contagion. Spot Ethereum ETFs had logged seven consecutive days of inflows totaling $127.4 million before the hack, suggesting institutional appetite remains – but this kind of headline risk is exactly what keeps the bigger allocators on the sideline.
The infrastructure is being tested. Whether it’s being hardened fast enough is the question that matters.
FAQ
How much was stolen in the KelpDAO hack?
Approximately $292 million in rsETH was drained from KelpDAO’s cross-chain bridge on April 18, 2026. The attackers manipulated the bridge infrastructure by compromising RPC nodes and running a DDoS attack to force verification failover to poisoned servers.
Why did the KelpDAO hack affect Aave?
The attackers deposited stolen, unbacked rsETH tokens into Aave as collateral and borrowed real ETH against them. This created roughly $200 million in bad debt on Aave, triggered a $6 billion withdrawal run, and pushed stablecoin lending pools to 100% utilization – trapping depositors who couldn’t withdraw their funds.
Who was behind the KelpDAO exploit?
LayerZero attributed the attack with preliminary confidence to North Korea’s Lazarus Group and its TraderTraitor subunit. The same group was linked to the $283 million Drift Protocol exploit on April 1, meaning Lazarus has drained over $575 million from DeFi in 18 days through two structurally different attack vectors.
