Hacks & scams / DeFi exploit
Background report. This happened on 2026-04-18. We publish it for context and as a reference. It is not today's news.
85severity
DeFi exploitcontainedEthereumUnichainEVM lending markets
Kelp DAO rsETH bridge exploit (Sentora-linked contagion): Kelp DAO rsETH bridge exploit: 116,500 unbacked rsETH (~$292M) minted, spreading stress through EVM lending
2026-04-18 · updated 2026-11-06 17:47 UTC · by Sentinel, VaultX incident desk
Reported loss$292MReported about $292M for 116,500 rsETH; some sources give $291M or round to $290M/$293M. Downstream DeFi outflows reported at $10.9B (Sentora, five days), $11.7B (Sentora writeup) and over $13B TVL (CoinDesk, two days). Not independently verified.
Attributionunknown in the provided research text. A CoinDesk URL slug in the research reads 'layerzero-blames-kelp-s-setup...attributes-it-to-north-korea-s-lazarus', suggesting LayerZero reportedly attributed the attack to North Korea's Lazarus Group, but the article body was not reviewed and no law-enforcement attribution is in the research.
Response score60/100An emergency pause was reportedly executed within about an hour, and the company has pursued legal action; however, the research shows no full post-mortem, compensation plan or verified recovery.
Severity85/100Roughly $292M direct loss plus reported multi-billion-dollar DeFi outflows across lending markets gives it systemic-risk characteristics.
According to Sentora, attackers exploited Kelp DAO's rsETH cross-chain bridge on April 18, 2026, minting 116,500 unbacked rsETH reported at about $292M. Rather than selling on DEXs, the attackers reportedly deposited the tokens into lending protocols and used rsETH's 1:1 oracle peg to ETH to borrow assets. Sentora and secondary outlets report large DeFi outflows in the days that followed, though the figures differ by source.
Get instant hack alerts
We message you the minute a major hack, exploit or fraud is confirmed, with the amount lost and what to do. Free, no spam, stop any time.
What happened
On April 18, 2026, attackers reportedly minted and used 116,500 rsETH, worth about $292M at the time, after bypassing Kelp DAO's cross-chain verification path, according to Sentora.
According to Sentora, the attackers deposited much of the unbacked rsETH into lending protocols instead of dumping it on DEXs, which Sentora says would have caused slippage and alerted MEV bots.
Sentora characterized the event as a localized bridge failure that triggered a much larger DeFi liquidity shock across EVM lending markets, with reported withdrawals of $10.9B over five days (about 21% of lending TVL) in one Sentora figure and $11.7B in another.
CoinDesk reported that DeFi TVL dropped by more than $13B over two days following the hack. Coverage names Aave, Euler and Morpho/Sentora strategies among affected venues or data sources.
According to the AltcoinBuzz URL in the research, KelpDAO has sued LayerZero and an individual named Pellegrino over the rsETH exploit.
How it worked
According to Sentora, attackers bypassed the 1-of-1 DVN (decentralized verifier network) and the bridge then accepted a forged cross-chain message.
Hypernative's reconstruction says the Ethereum-side rsETH adapter released 116,500 rsETH in response to a cross-chain message that never existed on Unichain. Hypernative's writeup is titled as a 'observation layer exploit'.
The minted rsETH was then used as collateral. Because rsETH is pegged 1:1 to ETH in the oracle used by lending protocols, the attackers could borrow real assets against unbacked tokens, which spread stress across lending markets.
Timeline
- 2026-04-18 17:35 UTCMain attack reportedly occurred, per one reconstruction cited in the research.
- 2026-04-18 18:21 UTCKelp DAO emergency pause reportedly followed, per one reconstruction.
- 2026-04-18Exploit date: 116,500 rsETH minted and used; Sentora later described it as a localized bridge failure.
- 2026-04-20CoinDesk reported DeFi TVL falling by more than $13B over two days following the hack.
Where the money went
Not established in the research. The research says the attackers used rsETH as collateral in lending protocols to borrow other assets, but it gives no verified address-level path, mixer use, bridge hops, exchange deposits, or frozen or recovered amounts.
The response
Kelp DAO reportedly triggered an emergency pause at about 18:21 UTC on April 18, 2026, per one reconstruction. Sentora published a research analysis and weekly digest on the contagion. KelpDAO reportedly filed a lawsuit against LayerZero and Pellegrino, per the AltcoinBuzz URL. The research does not describe a full remediation or compensation plan.
Market and user impact
The primary loss is about $292M in unbacked rsETH. Secondary impact on lending markets is reported at $10.9B to over $13B in outflows or TVL decline, depending on source and methodology. Sentora calls this a liquidity shock with contagion across EVM lending protocols. Individual user losses are not quantified in the research.
What people say
78% negative · 4% positive · the rest neutral · themes: bridge security failure, unbacked collateral risk, DeFi lending contagion, TVL outflows, legal dispute with LayerZero, conflicting loss figures
How to protect yourself
- Cross-chain bridges with a single verifier (such as a 1-of-1 DVN) create single points of failure; check the verifier configuration of any bridged asset you hold.
- Liquid restaking and bridged tokens used as lending collateral can spread a single bridge failure across many protocols; check oracle pegs and collateral concentration.
- If a bridged token's peg depends on an oracle, a forged mint can become borrowable value before the market reacts.
- Figures for the same incident differ by source and methodology; compare the primary post-mortem with secondary reports before relying on a single number.
Check a walletScan a tokenStill unknown
- Full post-mortem from KelpDAO or LayerZero and the verified root cause of the forged message.
- Whether the attribution to Lazarus Group (reportedly by LayerZero) is confirmed, and by which evidence.
- Address-level laundering path, mixer use and cross-chain hops for the stolen funds.
- Amounts frozen, recovered or compensated, and the outcome of the KelpDAO lawsuit.
- Final verified loss and contagion figures, since $291M, $292M and $293M and $10.9B to $13B+ are all reported.
- Whether a second attempt of about $95M, mentioned in one earlier draft, was actually detected and blocked; this is not supported by the research notes.
- Exact attacker addresses. An earlier draft cited an address, but it is not in the research notes and was not verified, so it is excluded here.
Related on VaultX
Binance multi-chain hack (TraderTraitor-linked): Binance loses a reported ~$6.3B across…Hack report · Binance disclosed a security incident on Oct. 29, 2026. Reports put the loss at about $6.3B, taken…Nomad Bridge exploit: Nomad bridge drained of ~$190M in Aug 2022 after a June upgrade…Hack report · On August 1, 2022, the Nomad bridge was drained of roughly $190M according to multiple reports…Bybit Ethereum cold wallet hack: Bybit loses about $1.46B in ETH from a cold wallet; FBI…Hack report · On Feb. 21, 2025, Bybit said one of its Ethereum cold wallets was compromised in a 'sophisticated…LayerZero review: MixedReview · Shipped cross-chain product and no regulator action found, but airdrop backlash, a $292M bridge…Ethereum review: SolidReview · Shipped, open-source and openly led; the main concerns are fees, past SEC scrutiny and hacks…Pepeto review: High riskReview · Presale meme project with live tools claims but widespread user reports of vanishing stakes &…Binance hit by reported $6.3B multi-chain theft; TraderTraitor link flaggedNews · Reports put Binance's multi-chain theft at about $6.3B, with ~$3B frozen. TRM Labs links it to…Polymarket explained: how prediction markets price real-world eventsGuide · How Polymarket works, how to read its Yes and No prices as probabilities, and what those prices…Crypto Stakes Ride on US Midterms as Markets Expect Democratic GainsNews · Prediction markets favored Democrats to win the House as crypto groups spent over $200 million on…BridgeGlossary · A bridge moves tokens from one blockchain to another.Ethereum (ETH)Glossary · Ethereum is a blockchain that runs programs called smart contracts. ETH is its native coin and…Cross-chain swapGlossary · A cross-chain swap exchanges a coin on one chain for a coin on another, for example BTC for SOL…
Sources
- Sentora research: Ecosystem stress test, the Kelp DAO contagion
- Sentora weekly digest
- Crypto.news on Sentora's figures
- AltcoinBuzz: KelpDAO sues LayerZero and Pellegrino over $292M rsETH exploit
- Hypernative: The KelpDAO observation layer exploit, $291M released on a message that never existed
- CoinDesk: DeFi TVL drops more than $13 billion in two days following Kelp DAO hack
- CoinInsider: KelpDAO hack triggers $13B DeFi TVL drop
How we report: Sentinel reads news, investigators' posts, company statements and on-chain data, attributes every claim to its source and marks unconfirmed numbers as reported. Severity measures size and systemic risk; the response score measures how fast and transparently users were protected. Not financial advice and not a finding of guilt. Corrections: contact us.
Get new hack reports as they happen
New exploit reports, major incidents and security updates from VaultX. Free. You choose below; nothing starts until you opt in.
On Telegram, press Start in the bot to subscribe. New reports are also posted on our alerts channel. Not financial advice. 
VaultX