DeFi Under Fire: Massive Kelp DAO Hack Highlights Security Risks

Summary

• Kelp DAO suffered a $293 million hack on April 18, 2026, the largest DeFi exploit of the year.
• The attack exploited a flaw in Kelp DAO's LayerZero-powered bridge, draining 18% of its rsETH supply.
• April 2026 saw over $600 million lost to DeFi hacks, exposing systemic security vulnerabilities.

On April 18, 2026, attackers hit Kelp DAO, a liquid restaking protocol, in the largest DeFi exploit of the year and stole $293 million. The hacker targeted a vulnerability in the platform's LayerZero-powered bridge, siphoning off 116,500 rsETH. That amount made up 18% of its circulating supply.

The crypto community felt the shock.

"The Kelp DAO exploit is a stark reminder that even advanced DeFi protocols are only as strong as their weakest link."

, Rob Behnke (Halborn)

The Broader DeFi Security Crisis

DeFi has long been hailed as the future of finance, promising transparency and autonomy through blockchain-based protocols. The rapid growth of these platforms often outpaces security audits and safeguards, so attackers see them as prime targets. Kelp DAO's breach shows how flaws in cross-chain bridges, a key part of interoperability, can cause huge losses.

This reveals a bigger problem.
The $600 million lost to hacks this month alone points to a systemic issue, as reports from PYMNTS explain. With DeFi's total value locked in the billions, developers and investors face high stakes.

Unpacking the Kelp DAO Exploit

The attacker pulled off a targeted operation on April 18, 2026, by exploiting a flaw in Kelp DAO's LayerZero bridge. That bridge handles asset transfers across blockchains, and the hacker used it to drain 116,500 rsETH. It was a significant part of the token's circulating supply.

What's alarming is the size of the loss.
At $293 million, the exploit tops other hacks in 2026 and underscores the dangers of value piled into untested systems, as Halborn details. Liquidity in rsETH dropped fast, and trust in Kelp DAO's setup plummeted right away.

The incident sparked calls for better security.

Community and Market Reaction

The crypto community reacted with alarm and frustration to the Kelp DAO hack. Many see it as proof of ongoing gaps in DeFi security, especially in cross-chain tech like LayerZero bridges. The $600 million in losses for April, as DefiLlama and Twitter/X show, has only added to the worries.

Markets took a hit amid existing volatility.
The psychological damage to investor confidence in DeFi is clear, though exact price effects on rsETH and other assets are still emerging. This string of exploits might slow adoption if trust doesn't recover soon.

The focus now is on the future.
Kelp DAO and the broader DeFi world must respond, with experts watching for fund recoveries or bridge fixes. This could push for tougher security audits and safeguards as the industry balances innovation and risk.