KelpDAO, a liquid restaking protocol, suffered a $290 million exploit involving its LayerZero-powered cross-chain bridge. On April 18, 2026, at approximately 17:35 UTC, an attacker was able to release 116,500 rsETH from the bridge contract on Ethereum mainnet without a corresponding burn event on a Layer 2. The amount represents roughly 18% of the rsETH circulating supply.
The attacker exploited a single point of failure in KelpDAO's 1-of-1 Decentralized Verifier Network (DVN) configuration, in which LayerZero Labs' DVN acted as the sole verifier. The funds were quickly distributed across multiple wallets and used as collateral across Aave V3, Compound V3, and Euler, allowing the attacker to borrow an estimated $236 million in WETH. Aave is facing significant bad debt exposure, potentially exceeding $170 million across deployments.
Tensions between LayerZero Labs, KelpDAO, Aave, and users are escalating as attribution of the attack remains unconfirmed, with responsibility still disputed.
Lido Earn lets you deploy ETH or stablecoins into curated DeFi strategies for optimised yield. Two vaults, daily rewards, automatic compounding, and first-loss protection. Get started on stake.lido.fi/earn
Notice - April 20, 2026: EarnETH has direct exposure to rsETH.
Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.
