KelpDAO exploit: $292M minted through a 1-of-1 LayerZero bridge, $177M bad debt now lands on Aave Umbrella

Rickler Feed (@rickler_feed), Apr 20, 2026, 18:10 UTC

KelpDAO exploit: $292M minted through a 1-of-1 LayerZero bridge, $177M bad debt now lands on Aave Umbrella The biggest DeFi extraction of 2026 didn’t come from a contract bug. It came from a single line of config. At 17:35 UTC on April 18, an attacker pushed a forged lzReceive call through KelpDAO’s LayerZero OFT adapter and minted 116,500 unbacked rsETH - roughly 18% of supply, ~$292M. One transaction, one signature. Root cause: the rsETH adapter was running requiredDVNCount: 1 with LayerZero Labs as the sole verifier. A $1B+ TVL protocol secured its bridge with a single point of failure.…

The excerpt is quoted from a public Telegram channel, which owns its text.

Read the original post on Telegram

More posts from Rickler Feed · All channels