2 weeks ago
14
Key Takeaways
- KelpDAO lost roughly $293 million in rsETH on April 18.
- The attacker minted unbacked tokens through a flaw in the cross-chain bridge and immediately used them as collateral on Aave.
- AAVE token dropped up to 14% within hours.
- By mid-April 2026, DeFi losses for the year have already crossed $450 million across roughly 45 protocols.
The attacker, whose initial funding was traced to Tornado Cash, identified and exploited a critical flaw in rsETH’s minting logic. Rather than providing actual collateral, the wallet was able to mint rsETH tokens without backing – effectively printing value out of nothing. The stolen tokens were then deposited into Aave V3 and V4, where they were used as collateral to borrow a substantial volume of WETH. By the time Kelp’s emergency “pauseAll” function was triggered – 46 minutes after the first successful drain – the protocol had already lost the bulk of its funds. Two subsequent attempts by the same attacker to drain an additional $100 million were b...
English (US)