ZachXBT Flags $280M+ KelpDAO Exploit Hitting Ethereum DeFi Lending Markets

[ad_1] Key Takeaways:

ZachXBT flagged a $280M+ theft throughout Ethereum and Arbitrum DeFi protocols on April 18, 2026. KelpDAO’s exploit created dangerous debt on Aave V3, with AAVE token dropping roughly 10-13%. KelpDAO has not confirmed the exploit; analysts are monitoring six recognized attacker wallets for restoration clues. Ethereum DeFi Exploit: KelpDAO rsETH Assault Drains Over $280 Million Onchain investigator ZachXBT posted the preliminary alert to his public Telegram channel shortly earlier than 3 p.m. ET, itemizing six pockets addresses tied to the theft and noting that the attacker wallets have been fund ed by way of Twister Money earlier than the drain started. His submit cited losses exceeding $280 million throughout a number of DeFi protocols with out naming KelpDAO instantly, however onchain ana lysts linked the addresses inside hours.

“KelpDAO seems to have had $280M+ stolen one hour in the past on Ethereum and Arbitrum,” ZachXBT wrote. “The assault addresses have been funded by way of Twister Money.”

Experiences point out the attackers exploited a flaw in KelpDAO’s rsETH infrastructure, triggering the unauthorized launch of a giant quantity of the liquid restaking token with out depositing new collateral. The acquired rsETH was then deposited into Aave V3 lending markets on each Ethereum and Arbitrum, the place the attacker borrowed important quantities of ETH and different belongings in opposition to it.

As soon as the collateral’s validity got here into query, these positions left Aave holding dangerous debt. Neighborhood estimates of whole losses ranged from $100 million to roughly $293 million, the equal of roughly 116,500 rsETH at present costs.

AAVE dropped sharply on the information. Market information exhibits the decline between 10% and 13% inside hours of the preliminary alert, because the market weighed potential dangerous debt publicity throughout the protocol’s lending swimming pools. The AAVE multisig guardian froze rsETH on lending markets, based on onchain information.

Liquid restaking tokens like rsETH sit deep inside DeFi composability. They're accepted as collateral on a number of lending markets concurrently, which suggests the exploit can unfold losses rapidly throughout platforms. The KelpDAO incident illustrates that threat instantly.

Attacker wallets listed by ZachXBT confirmed giant ETH positions held on Aave and Compound. One deal with alone reportedly held roughly $120 million in ETH on Aave on the time of detection. Funds have been moved rapidly after the drain.

Using Twister Money to pre-fund operational wallets earlier than the assault is a normal tactic for attackers making an attempt to obscure origins. It doesn't point out a brand new method, but it surely confirms the operation was deliberate and deliberate.

As of roughly 3 p.m. ET on April 18, KelpDAO had not revealed an official assertion or autopsy. The group was watching the undertaking’s X account and web site for a response, in addition to Aave govern ance channels for any emergency actions.

DeFi secu rity corporations, together with Peckshield, Slowmist, and others, had not but revealed detailed breakdowns on the time of writing, reflecting how rapidly the state of affairs developed. ZachXBT had not posted a follow-up particularly naming KelpDAO in public channels, however the deal with overlap drew a transparent line.

<img alt="Drift Protocol Hack 2026: What Happened, Who Lost Money, and What’s Next" loading="lazy" decoding="async" data-nimg="fill" class="object-cover" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent" sizes="(max-width: 768px) calc(100vw - 18px)" srcset="/_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=32&q=75 32w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=48&q=75 48w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=64&q=75 64w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=128&q=75 128w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=256&q=75 256w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=384&q=75 384w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=640&q=75 640w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=828&q=75 828w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=1080&q=75 1080w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=1200&q=75 1200w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=1920&q=75 1920w" src="https://news.bitcoin.com/_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-760x428.png&w=1920&q=75"/> Drift Protocol Hack 2026: What Occurred, Who Misplaced Cash, and What’s Subsequent A Solana-based perpetual futures alternate misplaced $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks…

Learn Now <img alt="Drift Protocol Hack 2026: What Happened, Who Lost Money, and What’s Next" loading="lazy" decoding="async" data-nimg="fill" class="object-cover" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent" sizes="150px" srcset="/_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=32&q=75 32w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=48&q=75 48w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=64&q=75 64w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=128&q=75 128w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=256&q=75 256w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=384&q=75 384w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=640&q=75 640w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=828&q=75 828w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1080&q=75 1080w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1200&q=75 1200w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1920&q=75 1920w" src="https://news.bitcoin.com/_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1920&q=75"/> Drift Protocol Hack 2026: What Occurred, Who Misplaced Cash, and What’s Subsequent A Solana-based perpetual futures alternate misplaced $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks…

Learn Now <img alt="Drift Protocol Hack 2026: What Happened, Who Lost Money, and What’s Next" loading="lazy" decoding="async" data-nimg="fill" class="object-cover" style="position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent" sizes="150px" srcset="/_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=32&q=75 32w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=48&q=75 48w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=64&q=75 64w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=128&q=75 128w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=256&q=75 256w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=384&q=75 384w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=640&q=75 640w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=828&q=75 828w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1080&q=75 1080w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1200&q=75 1200w, /_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1920&q=75 1920w" src="https://news.bitcoin.com/_next/image/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&w=1920&q=75"/> Drift Protocol Hack 2026: What Occurred, Who Misplaced Cash, and What’s Subsequent Learn Now A Solana-based perpetual futures alternate misplaced $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks…

This incident is separate from the Drift Protocol exploit first reported on by Bitcoin.com Information on April 1, 2026, which concerned roughly $280 million drained totally on Solana earlier than USDC was bridged to E thereum by way of CCTP. The mechanics, chains, and timelines are distinct.

Anybody holding rsETH or associated positions on Aave, Compound, or different lending markets was being suggested by group members to assessment publicity whereas the state of affairs remained unresolved.

The six attacker wallets recognized by ZachXBT stay lively targets for onchain tracing as analysts work to map the place the funds moved after leaving Aave.

Editor’s notice: This text was up to date at 4 p.m. ET to notice that the Aave multisig guardian froze rsETH on particular lending markets.

[ad_2] Source link

ZachXBT Flags $280M+ KelpDAO Exploit Hitting Ethereum DeFi Lending Markets

Pakistan Ends Seven-Yr Crypto Banking Ban however Bars Buying and selling by Banks

Circle Drops USDC Bridge: $500M+ Every day Flows Go Seamless Throughout Chains Immediately

Stablecoins Adoption: French Finance Minister Pushes For Extra Euro-Backed Tokens

greater

Related Posts

Pakistan Ends Seven-Yr Crypto Banking Ban however Bars Buying and selling by Banks

Circle Drops USDC Bridge: $500M+ Every day Flows Go Seamless Throughout Chains Immediately

Stablecoins Adoption: French Finance Minister Pushes For Extra Euro-Backed Tokens

The 'TradFi-ing' of Crypto: Financial institution of Korea Pushes to Impose Inventory Market Guidelines on Exchanges

RAVE Crashes 68% as Binance and Bitget Examine Manipulation Claims

XRP Explodes Cross-Chain: Solana Unlocks wXRP Entry Throughout Apps in Main Transfer

Jury finds Reside Nation, Ticketmaster had anti-competitive monopoly over large live performance venues

Techmeme: Anthropic's Mythos provides to considerations about rising workloads for open-source maintainers, as many have already been coping with a “loopy” variety of bug studies (Chris Stokel-Walker/Bloomberg)

Recommended Stories

WATCH: Donald Trump indicators Government Order as photographs fired in Strait of Hormuz

Air Power Academy culminating coaching places cadets by battle situation

Hegseth goes viral for 'Pulp Fiction' prayer on the Pentagon

Popular Stories

Which one in every of Elon Musk’s exes was a gold digger?

Charlie Kirk homicide suspect faces listening to on excluding information cameras

Elon Musk AVID GAMER Couldn't Play ANY Due To Work However By some means Discovered A Means To Mix Work With Play

Regardless of mutual threats US President Donald Trump says the warfare with Iran may finish quickly | DW

Spain’s Sánchez builds anti-Trump coalition on the lookout for political lifeline at dwelling

Categories

Site Map

Recent Posts

Welcome Back!

Create New Account!

Retrieve your password

Add New Playlist

Are you sure want to unlock this post?

Are you sure want to cancel subscription?

ZachXBT Flags $280M+ KelpDAO Exploit Hitting Ethereum DeFi Lending Markets

RELATED POSTS

Support Greater and Subscribe to view content

Subscribe

Related Posts

Recommended Stories

Popular Stories

Categories

Site Map

Recent Posts

Welcome Back!

Create New Account!

Retrieve your password

Add New Playlist

Are you sure want to unlock this post?

Are you sure want to cancel subscription?