The biggest DeFi heist of 2026, hackers easily took advantage of Aave
Author: Xiao Bing, Shenchao TechFlow
On the evening of April 18 at 17:35 (UTC), a wallet that had laundered money through Tornado Cash sent a cross-chain message to the LayerZero EndpointV2 contract.
The message's meaning was simple: a user on a certain chain wanted to transfer rsETH back to the Ethereum mainnet. LayerZero faithfully conveyed the instruction according to the protocol design. The bridging contract deployed by Kelp DAO on the mainnet also executed the release faithfully as designed.
116,500 rsETH, worth approximately $292 million at the time, was transferred in a single transaction to an address controlled by the attacker.
The problem is that no one on the other chain had ever deposited this rsETH. This "cross-chain request" was fabricated out of thin air; LayerZero believed it, and Kelp's bridge believed it.
Forty-six minutes later, Kelp's emergency multi-signature finally hit the pause button. By this time, the attacker had already completed the latter half of the action, using the stolen, essentially uncollateralized rsETH to collateralize in Aave V3, borrowing approximately $236 million worth of wETH.
This is the largest DeFi theft of 2026 so far, surpassing the Drift protocol, which was attacked by North Korean hackers on April 1 by several million dollars, but what truly sends chills down the spine of the industry is not just the amount.
How the Attack Happened: Three Bets from 17:35 to 18:28
Let's restore the timeline.
17:35 UTC, the first success. The attacker called the lzReceive function on the LayerZero EndpointV2 contract, and a wallet funded by Tornado Cash sent a fabricated cross-chain data packet to Kelp's bridging contract. The contract verification passed, and 116,500 rsETH was released to the attacker's address. A single transaction. Clean.
18:21 UTC, Kelp's emergency pause multi-signature froze the core rsETH contracts on the mainnet and multiple L2s. 46 minutes after the attack occurred.
18:26 and 18:28 UTC, the attacker initiated two more attempts, each time attempting to withdraw 40,000 rsETH (approximately $10 million) with a LayerZero data packet. Both were reverted; the contract had already been frozen, but the attacker was clearly still trying to siphon off the remaining liquidity.
From the first success to Kelp's public statement, nearly three hours elapsed.
Kelp's first X post was not sent until 20:10 UTC, and the wording was very restrained: suspicious cross-chain activity involving rsETH was detected, the rsETH contracts on the mainnet and multiple L2s had been paused, and they were collaborating with LayerZero, Unichain, auditors, and external security experts for root cause analysis.
However, earlier than the official statement, ZachXBT, an on-chain detective, raised the alarm in his Telegram channel before 3 PM Eastern Time, listing six wallet addresses related to the theft and pointing out that the attack wallet had prepared funds through Tornado Cash before starting its actions. He did not name Kelp DAO, but on-chain analysts connected the addresses in just a few hours.
This was a **premeditated operation executed
You may also like

Cook Passes the Baton, Anthropic Gears Up | Rewire News Morning Brief

Will the Fed Cut Interest Rates Again? Tonight's Data Is Key

The person taking over Apple has to do something he has never done before

Why Are You Always Losing Money on Polymarket? Because You're Betting on News, While The Rulebook Favors Insiders

Not a Price Hike, but a Supply Shortage? Oil Price Has Crossed the Threshold

a16z: 5 Ways Blockchain Helps AI Agent Infrastructure

Morning News | The Hong Kong Securities and Futures Commission announced the regulatory framework for secondary market trading of tokenized investment products; Strategy increased its holdings by 34,164 bitcoins last week; KAIO completed a strategic fi...

What Is an XRP Wallet? The Best Wallets to Store XRP (2026 Updated)
An XRP wallet lets you safely store, send, and receive XRP on the XRP Ledger. Learn what wallets support XRP and discover the best XRP wallets for beginners and long-term holders in 2026.

What are the Top AI Crypto Coins? Render vs. Akash: 5 Gems Solving the 2026 GPU Crisis
What are the best AI crypto coins for the 2026 cycle? Beyond the hype, we analyze top tokens like RNDR, AKT, and FET that provide real-world solutions to the global GPU shortage and the rise of autonomous agents.

What Is a Token in AI? What Is an AI Token + 3 Gems You Can't Miss in 2026
The era of AI hype has transitioned into an era of utility. As we move through Q2 2026, the market is no longer rewarding "narrative-only" projects. At WEEX Research, we are seeing a massive capital rotation into Decentralized Compute (DePIN) and Autonomous Agent coordination layers. This guide analyzes which AI tokens are capturing institutional liquidity and how to spot high-conviction setups in a maturing market.

Consumer-grade Crypto Global Survey: Users, Revenue, and Track Distribution

Prediction Markets Under Bias

Stolen: $290 million, Three Parties Refusing to Acknowledge, Who Should Foot the Bill for the KelpDAO Incident Resolution?

ASTEROID Pumped 10,000x in Three Days, Is Meme Season Back on Ethereum?

ChainCatcher Hong Kong Themed Forum Highlights: Decoding the Growth Engine Under the Integration of Crypto Assets and Smart Economy

Why can this institution still grow by 150% when the scale of leading crypto VCs has shrunk significantly?

Anthropic's $1 trillion, compared to DeepSeek's $100 billion


