DEFI DEBACLE: $300M Exploit Leaves Kelp DAO, LayerZero, And Aave Pointing Fingers!

Nearly $300 million was drained in a major DeFi exploit, and it’s still unclear exactly what happened or how it’ll be resolved.

This weekend’s DeFi debacle saw attackers exploit Kelp DAO, a major liquid restaking protocol on Ethereum, by targeting its LayerZero bridge and tricking it into releasing 116,500 rsETH, worth nearly $300 million in unbacked assets.

The stolen rsETH was then dumped onto Aave as collateral, allowing the attackers to borrow massive amounts of WETH and leaving the platform staring down nine figures in potential bad debt.

Since then, fear of contagion spread across DeFi as LayerZero blames Kelp DAO for not requiring enough Decentralized Verifier Networks (DVNs), Kelp DAO blames LayerZero for an insecure multichain bridge, and no one is quite sure how this gets resolved.

“LZ blaming Kelp. Kelp blaming LZ. Aave saying their hands are tied,” Yuga Labs VP of Blockchain 0xQuit tweeted. “ In truth nobody escapes blame. Kelp should have required more DVNs, or rate limits, or both. LZ should have not let their DVN get pwned. Aave should not have onboarded a poorly secured token as collateral.”

 

Tonight, Aave released its rsETH incident report, explaining that the issue has been contained on its end, but what comes next still hangs over DeFi and is now in the hands of Kelp.

 

In its report, Aave outlined two possible scenarios: 

1. A broad “socialized loss,” where all rsETH holders take roughly a 15% hit to help cover the shortfall, or

2. Losses are isolated to L2 users holding the bridged rsETH, who could face significantly larger losses.

 

You can read Aave’s full incident report here: https://governance.aave.com/t/rseth-incident-report-april-20-2026/24580

 

 

The Gazette will continue to follow this DeFi debacle and will keep you updated as more information becomes available. Stay tuned.