Kelp DAO’s $292 Million Hack Is 2026’s Largest Crypto Exploit

Crypto protocols rely on smart contracts and cross-chain bridges to transfer assets, but exploited software vulnerabilities can allow funds to be moved within a short period. Security incidents involving major protocols including KelpDAO and Drift Protocol also underscore how cross-chain infrastructure has become a central source of market risk.

There were 83 crypto security incidents in the second quarter of 2026, from April 1 through June 30, the highest quarterly total on record. Combined losses reached $755 million. Cross-chain bridge vulnerabilities were the main attack vector, with the KelpDAO hack and the Drift Protocol vulnerability accounting for a very large share of the quarter’s losses.

Kelp DAO is an Ethereum liquid restaking protocol whose rsETH token supports cross-chain deployment, redemptions and reward accrual. Around mid-June 2026, hackers from North Korea’s Lazarus Group stole $293 million in assets, creating a collateral shortfall and disrupting liquidity on Aave. The incident highlighted the systemic risks arising from interdependencies among DeFi protocols.

Kelp DAO said in July 2026 that it had completed a five-week recovery plan, fully restoring rsETH’s cross-chain functionality, redemptions and reward mechanism. A coalition of protocols called “DeFi United” jointly injected funds to cover the $293 million shortfall caused by the attack while easing liquidity pressure on Aave.

Kelp DAO’s rsETH is a cross-chain liquid restaking token that relies on messaging and verification infrastructure to keep assets consistent across blockchains. After an April security exploit involving $292 million, Kelp blamed LayerZero’s mechanism for creating the risk. LayerZero said the problem stemmed from Kelp’s configuration, sparking debate across the DeFi industry over responsibility.

Kelp DAO has announced that it will migrate rsETH’s cross-chain architecture to Chainlink CCIP, affecting about $3 billion in DeFi funds. LayerZero subsequently issued a public apology, acknowledged a design flaw in its 1/1 DVN configuration and upgraded its default verification standard to 5/5. The change has also prompted other protocols to reassess their cross-chain service and oracle providers.

Bitcoin is widely viewed as a key gauge of global risk appetite, while total value locked (TVL) in DeFi reflects the amount of capital deployed on-chain. The cryptocurrency’s stabilization coincided with a KelpDAO security breach, underscoring the coexistence of market resilience and protocol risk while reshaping flows involving Aave, Maker Spark and USDC.

KelpDAO suffered an exploit worth about $292 million over the weekend of July 18–19, 2026. DeFi TVL subsequently fell by about $14 billion at one point to a one-year low, although analysts attributed roughly $13 billion of the decline to cascading liquidations rather than actual losses. Bitcoin rebounded after falling below $74,000 and reclaimed $76,000.