KelpDAO Hit by Major Exploit Exceeding $280 Million in Losses

On April 18, 2026, the decentralized finance (DeFi) sector faced a significant setback as an exploit targeting KelpDAO’s rsETH liquid restaking token reportedly led to losses surpassing $280 million across Ethereum and Arbitrum. The news came from blockchain investigator ZachXBT, who alerted the community around 3 p.m. ET via his Telegram channel.

While ZachXBT did not name KelpDAO explicitly in his initial warning, he highlighted six wallet addresses linked to the exploit. It was noted that these wallets had been funded through Tornado Cash prior to the incident, a method often employed by attackers to obfuscate their identities.

TRUSTED PARTNER

4.9 ★★★★☆

Review and Opinions →

🔥 100% Up to 500$

1 Bonus + 200 Spin 🏆

Open an account

The exploit appears to have stemmed from a flaw in KelpDAO’s infrastructure concerning the rsETH token, allowing a malicious actor to extract a large quantity of the token without sufficient collateral. This exploit enabled the attacker to deposit the obtained rsETH into Aave V3 lending markets on both Ethereum and Arbitrum, where they secured substantial loans in ETH and other assets.

Subsequently, doubts arose regarding the validity of these collateral positions, leaving Aave exposed to bad debt. Estimates suggest that losses could be between $100 million and $293 million, equating to around 116,500 rsETH at current valuations.

In the wake of the incident, the AAVE token’s value plummeted by approximately 10 to 13%, reflecting investor concern over potential bad debt exposure in the protocol’s lending ecosystem. To mitigate risks, the AAVE multisig guardian responded by freezing rsETH on lending platforms.

The KelpDAO incident serves as a stark reminder of the risks associated with liquid restaking tokens, which can be leveraged as collateral across multiple lending markets. This vulnerability allows losses to propagate rapidly throughout the DeFi landscape.

Analysis of the identified attacker wallets revealed substantial holdings of ETH on Aave and Compound, with one wallet alone containing about $120 million in ETH at the time of the incident. Following the exploit, the stolen funds were promptly shifted to obscure their trail.

TRUSTED PARTNER

3.9 ★★★☆☆

Review and Opinions →

🔥 Bonus 1.400 $

Bonus Instant + 225 FS 🏆

Open an account

The use of Tornado Cash to fund attacker wallets before executing such exploits is a calculated strategy to disguise the origins of stolen funds, underscoring the premeditated nature of the operation.

As of late afternoon on April 18, no official confirmation from KelpDAO about the exploit had been released. The community remained vigilant, anticipating updates through the project’s X account and website, as well as Aave’s governance channels to address potential emergency measures.

DeFi security firms, including Peckshield and Slowmist, had not produced detailed analyses at the time of this report, highlighting the swift evolution of this situation. Nevertheless, it was evident from the overlapping addresses that linked the attack to KelpDAO.

This incident is part of a broader pattern of vulnerabilities within the DeFi sector, where both small and large-scale exploits can have a cascading impact on market stability and investor confidence. The ongoing monitoring of the identified wallets continues as analysts strive to trace the movement of the compromised funds.