A hacker has drained hundreds of millions of dollars from the liquid restaking protocol Kelp DAO, marking the biggest decentralized finance (DeFi) hack of 2026.
In a new post on X, on-chain intelligence firm Lookonchain says the thief minted tens of thousands of Kelp DAO’s restaked Ethereum (rsETH) and used it as collateral to acquire ETH itself.
“KelpDAO was exploited, with ~$294M stolen. The attacker minted 116,500 rsETH ($294M). By selling rsETH and using it as collateral to borrow ETH, the attacker obtained 106,467 ETH ($250M).”
Lookonchain says the influx of stolen rsETH on Aave (AAVE) has triggered an exodus of crypto whales on the DeFi protocol.
“Due to the KelpDAO exploiter borrowing over 82,600 ETH ($195M) from Aave using RSETH as collateral, bad debt has appeared on Aave.
Many whales have withdrawn funds from Aave, causing its TVL (total value locked) to drop from $26.396B to $20.114B — a decline of $6.28B.
Major withdrawals include:
• MEXC withdrew $431M
• Whale 0x7CD0 (possibly linked to Nonco) withdrew $405.7M
• Abraxas Capital withdrew $392M.”
KelpDAO has confirmed the attack, announcing it had moved to contain the damage by halting activity across its contracts.
“Earlier [on April 19th], we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate. We are working with LayerZero, Unichain, our auditors and top security experts on RCA.”
Amid the chaos, Tron (TRX) founder Justin Sun stepped up to address the hacker directly and publicly on X.
“OK — KelpDAO hacker, how much do you want? Let’s just talk. With KelpDAO’s help, of course. It’s simply not worth it to sacrifice both Aave and KelpDAO and let them go down over this hack. You can’t spend $300 million anyway.”
Data from the deanonymizing blockchain intelligence tool Arkham shows that the hacker currently holds over $242.564 million in crypto and has been actively moving coins to the decentralized exchange Uniswap, where the tokens could be sold on the open market.
Disclaimer: Opinions expressed at CapitalAI Daily are not investment advice. Investors should do their own due diligence before making any decisions involving securities, cryptocurrencies, or digital assets. Your transfers and trades are at your own risk, and any losses you may incur are your responsibility. CapitalAI Daily does not recommend the buying or selling of any assets, nor is CapitalAI Daily an investment advisor. See our Editorial Standards and Terms of Use.