Key Highlights

  • Kelp DAO suffered a $292 million exploit on April 18 through a compromised LayerZero bridge, the largest single DeFi hack of 2026 and the immediate trigger for a sector-wide TVL collapse.

  • Total DeFi losses across April reached $606.2 million over 12 incidents, with Kelp DAO and the earlier Drift Protocol exploit accounting for roughly $572 million of that figure.

  • DeFi's total value locked dropped to $82.4 billion, a one-year low and a 25% retreat from the $110 billion registered at the start of 2026.


Kelp DAO's rsETH bridge was drained of 116,500 rsETH tokens on April 18 in what became the defining hack of a brutal month for decentralized finance. The attack went through a LayerZero-powered bridge: attackers poisoned servers that LayerZero's verifier relied on to validate cross-chain messages, then pushed a fabricated instruction that released the liquid restaking tokens directly to wallets under attacker control.


The damage compounded quickly. Stolen rsETH was deposited as collateral on Aave v3, where attackers borrowed wrapped ETH against it, generating approximately $195 million in bad debt within the Aave system. Aave TVL shed $8.45 billion in the 48 hours that followed, and the AAVE token fell roughly 20%, sliding from $112 to $89.50.


Attribution has become a secondary dispute. LayerZero pointed to Lazarus Group, the North Korean state-sponsored collective also linked to a string of earlier crypto thefts. Kelp DAO pushed back, arguing that LayerZero's default single-verifier configuration was the structural weakness that made the attack possible, and that attribution does not settle the question of who bears responsibility for that design choice.


The Kelp DAO incident capped a stretch that had already included Drift Protocol's $280 million loss on April 1, the Rhea Finance oracle manipulation that totalled $18.4 million, a $1.2 million CoW Swap incident on April 14, and several smaller drains. At $606.2 million across 12 incidents, April is tracking as the worst month for protocol losses since February 2025.