{"id":71333,"date":"2026-04-18T19:58:29","date_gmt":"2026-04-18T19:58:29","guid":{"rendered":"https:\/\/crowdfundjunction.com\/blog\/zachxbt-flags-280m-kelpdao-exploit-hitting-ethereum-defi-lending-markets\/"},"modified":"2026-04-18T19:58:29","modified_gmt":"2026-04-18T19:58:29","slug":"zachxbt-flags-280m-kelpdao-exploit-hitting-ethereum-defi-lending-markets","status":"publish","type":"post","link":"https:\/\/crowdfundjunction.com\/blog\/zachxbt-flags-280m-kelpdao-exploit-hitting-ethereum-defi-lending-markets\/","title":{"rendered":"ZachXBT Flags $280M+ KelpDAO Exploit Hitting Ethereum DeFi Lending Markets"},"content":{"rendered":"<p><b>(Originally posted on : Bitcoin News )<\/b><br \/>\n<\/p>\n<div>\n<p><strong>Key Takeaways:<\/strong><\/p>\n<ul>\n<li>ZachXBT flagged a $280M+ theft across Ethereum and Arbitrum <span>DeFi<\/span> protocols on April 18, 2026.<\/li>\n<li>KelpDAO\u2019s bridge exploit created bad debt on Aave V3, with AAVE token dropping roughly 10-13%.<\/li>\n<li>KelpDAO has not confirmed the exploit; analysts are monitoring six identified attacker wallets for recovery clues.<\/li>\n<\/ul>\n<h2>Ethereum <span>DeFi<\/span> Exploit: KelpDAO rsETH Attack Drains Over $280 Million<\/h2>\n<p>Onchain investigator <a href=\"https:\/\/x.com\/zachxbt\" target=\"_blank\" rel=\"noopener noreferrer\">ZachXBT<\/a> posted the <a href=\"https:\/\/t.me\/investigations\/314\" target=\"_blank\" rel=\"noopener noreferrer\">initial alert<\/a> to his public Telegram channel shortly before 3 p.m. ET, listing six wallet addresses tied to the theft and noting that the attacker wallets were fund<span style=\"font-weight:400\">ed through <a href=\"https:\/\/news.bitcoin.com\/roman-storms-tornado-cash-verdict-what-it-means-for-crypto\/\">Tornado Cash<\/a> before the drain began. His post cited losses exceeding $280 million across multiple <span>DeFi<\/span> protocols without naming KelpDAO directly, but onchain ana<\/span>lysts connected the addresses within hours.<\/p>\n<p>\u201cKelpDAO appears to have had $280M+ stolen one hour ago on Ethereum and Arbitrum,\u201d ZachXBT wrote. \u201cThe attack addresses were funded via Tornado Cash.\u201d<\/p>\n<p>Reports indicate the attackers exploited a flaw in KelpDAO\u2019s Layerzero-powered bridge, triggering the unauthorized release of a large <span>volume<\/span> of rsETH without depositing new collateral. The acquired rsETH was then deposited into <span class=\"hover:entity-accent entity-underline inline cursor-pointer align-baseline\"><span class=\"whitespace-normal\">Aave<\/span><\/span>V3 lending markets on both <span class=\"hover:entity-accent entity-underline inline cursor-pointer align-baseline\"><span class=\"whitespace-normal\">Ethereum<\/span><\/span> and <span class=\"hover:entity-accent entity-underline inline cursor-pointer align-baseline\"><span class=\"whitespace-normal\">Arbitrum<\/span><\/span>, where the attacker borrowed significant amounts of <span>ETH<\/span> and other assets against it.<\/p>\n<p><span style=\"font-weight:400\">Once the collateral\u2019s validity came into question, those positions left Aave holding bad debt. Community estimates of total losses ranged from <a href=\"https:\/\/x.com\/AggrNews\/status\/2045572650085339189?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">$100 million<\/a> to roughly $293 million, the equivalent of approximately 116,500 rsETH at current prices.<\/span><\/p>\n<p><span style=\"font-weight:400\">AAVE dropped sharply on the news. Market data shows the decline between 10% and 13% within hours of the initial alert, as the market weighed potential bad debt exposure across the protocol\u2019s lending pools.<\/span><\/p>\n<p>Liquid <span>restaking<\/span> tokens like rsETH sit deep inside <span>DeFi<\/span> composability. They are accepted as collateral on multiple lending markets simultaneously, which means the exploit can spread losses quickly across platforms. The KelpDAO incident illustrates that risk directly.<\/p>\n<p>Attacker wallets listed by ZachXBT showed large <span>ETH<\/span> positions held on <a href=\"https:\/\/news.bitcoin.com\/aave-labs-secures-25m-stablecoin-grant-as-dao-formalizes-revenue-control-model\/\">Aave<\/a> and Compound. One address alone reportedly held approximately $120 million in <a href=\"https:\/\/branch.wallet.bitcoin.com\/news-contextual-eth\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">ETH<\/a> on Aave at the time of detection. Funds were moved quickly after the drain.<\/p>\n<p>The use of Tornado Cash to pre-fund operational wallets before the attack is a standard tactic for attackers trying to obscure origins. It does not indicate a new technique, but it confirms the operation was deliberate and planned.<\/p>\n<p> <iframe src=\"https:\/\/markets.bitcoin.com\/crypto\/aave\/embed\" width=\"100%\" style=\"max-height:500px;height:500px;border:none;overflow:hidden;border-radius:4px\" scrolling=\"no\" title=\"aave market data\"><\/iframe> <\/p>\n<p>As of approximately 3 p.m. ET on April 18, KelpDAO had not published an official statement or post-mortem. The community was watching the project\u2019s X account and website for a response, as well as Aave govern<span style=\"font-weight:400\">ance channels for any emergency actions.<\/span><\/p>\n<p><span style=\"font-weight:400\"> <a href=\"http:\/\/www.bitcoin.com\/get-started\/what-is-defi-decentralized-finance\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">DeFi<\/a> secu<\/span>rity firms, including Peckshield, Slowmist, and others, had not yet published detailed breakdowns at the time of writing, reflecting how quickly the situation developed. ZachXBT had not posted a follow-up specifically naming <a href=\"https:\/\/x.com\/KelpDAO\" target=\"_blank\" rel=\"noopener noreferrer\">KelpDAO<\/a> in public channels, but the address overlap drew a clear line.<\/p>\n<div class=\"not-prose my-3 lg:my-4\">\n<div class=\"flex flex-col overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] md:hidden\">\n<div class=\"relative aspect-video w-full overflow-hidden rounded-[15px]\"><\/p>\n<h3 class=\"absolute inset-x-0 bottom-0 m-0 p-3 text-xl font-bold capitalize leading-[1.17] tracking-[-0.4px] !text-white\">Drift Protocol Hack 2026: What Happened, Who Lost Money, and What\u2019s Next<\/h3>\n<\/div>\n<div class=\"flex flex-col gap-2.5 px-1 pt-2.5 pb-1\">\n<p class=\"m-0 line-clamp-2 text-xs leading-[1.3] !text-[#67656E]\">A Solana-based perpetual futures exchange lost $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks\u2026<\/p>\n<p><a class=\"flex h-[38px] w-full items-center justify-center rounded-pill bg-[#4169E1] text-sm font-medium text-white no-underline\" href=\"https:\/\/news.bitcoin.com\/drift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next\/\">Read Now<\/a><\/div>\n<\/div>\n<div class=\"hidden overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] md:flex md:flex-row md:gap-3 lg:hidden\">\n<div class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\"><img alt=\"Drift Protocol Hack 2026: What Happened, Who Lost Money, and What\u2019s Next\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img src=\"https:\/\/news.bitcoin.com\/images\/uploads\/bitcoin_news_newlogo.svg\" alt=\"Bitcoin.com News\" class=\"size-7\" loading=\"lazy\"\/><\/div>\n<\/div>\n<div class=\"flex min-w-0 flex-1 flex-col justify-between gap-2\">\n<h3 class=\"m-0 line-clamp-3 text-xl font-bold capitalize leading-[1.17] tracking-[-0.4px] !text-[#1C1C1C]\">Drift Protocol Hack 2026: What Happened, Who Lost Money, and What\u2019s Next<\/h3>\n<p class=\"m-0 line-clamp-2 text-sm leading-[1.3] !text-[#67656E]\">A Solana-based perpetual futures exchange lost $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks\u2026<\/p>\n<p><a class=\"flex h-[38px] w-full items-center justify-center rounded-pill bg-[#4169E1] text-sm font-medium text-white no-underline\" href=\"https:\/\/news.bitcoin.com\/drift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next\/\">Read Now<\/a><\/div>\n<\/div>\n<div class=\"hidden overflow-hidden rounded-lg !bg-[#E8EDFA] p-[9px] lg:flex lg:flex-row lg:gap-4\">\n<div class=\"relative size-[150px] min-w-[150px] shrink-0 overflow-hidden rounded-[15px]\"><img alt=\"Drift Protocol Hack 2026: What Happened, Who Lost Money, and What\u2019s Next\" loading=\"lazy\" decoding=\"async\" data-nimg=\"fill\" class=\"object-cover\" style=\"position:absolute;height:100%;width:100%;left:0;top:0;right:0;bottom:0;color:transparent\" sizes=\"150px\" srcset=\"\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=32&amp;q=75 32w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=48&amp;q=75 48w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=64&amp;q=75 64w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=128&amp;q=75 128w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=256&amp;q=75 256w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=384&amp;q=75 384w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=640&amp;q=75 640w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=828&amp;q=75 828w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1080&amp;q=75 1080w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1200&amp;q=75 1200w, \/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1920&amp;q=75 1920w\" src=\"https:\/\/news.bitcoin.com\/_next\/image\/?url=https%3A%2F%2Fstatic.news.bitcoin.com%2Fwp-content%2Fuploads%2F2026%2F04%2Fdrift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next-150x150.png&amp;w=1920&amp;q=75\"\/><\/p>\n<div class=\"absolute left-2 top-2\"><img src=\"https:\/\/news.bitcoin.com\/images\/uploads\/bitcoin_news_newlogo.svg\" alt=\"Bitcoin.com News\" class=\"size-7\" loading=\"lazy\"\/><\/div>\n<\/div>\n<div class=\"flex min-w-0 flex-1 flex-col justify-center gap-2\">\n<div class=\"flex items-start gap-3\">\n<h3 class=\"m-0 min-w-0 flex-1 line-clamp-2 text-2xl font-bold capitalize leading-[1.17] tracking-[-0.48px] !text-[#1C1C1C]\">Drift Protocol Hack 2026: What Happened, Who Lost Money, and What\u2019s Next<\/h3>\n<p><a class=\"flex h-12 w-[180px] shrink-0 items-center justify-center rounded-pill bg-[#4169E1] text-sm font-medium text-white no-underline\" href=\"https:\/\/news.bitcoin.com\/drift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next\/\">Read Now<\/a><\/div>\n<p class=\"m-0 line-clamp-2 text-base leading-[1.3] !text-[#67656E]\">A Solana-based perpetual futures exchange lost $286 million in 12 minutes on April 1, 2026, after attackers spent three weeks\u2026<\/p>\n<\/div>\n<\/div>\n<\/div>\n<p>This incident is separate from the <a href=\"https:\/\/news.bitcoin.com\/drift-protocol-hack-2026-what-happened-who-lost-money-and-whats-next\/\">Drift Protocol exploit<\/a> first <a href=\"https:\/\/news.bitcoin.com\/drift-protocol-sol-exploit-sees-over-200m-drained-biggest-defi-hack-of-2026\/\">reported<\/a> on by <a href=\"https:\/\/www.bitcoin.com\/\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">Bitcoin.com<\/a> News on April 1, 2026, which involved roughly $280 million drained primarily on <a href=\"https:\/\/markets.bitcoin.com\/crypto\/solana?utm_source=bitcoin_news\" class=\"lar_link lar_link_outgoing\" target=\"_blank\" rel=\"noopener noreferrer\">Solana<\/a> before USDC was bridged to E<span style=\"font-weight:400\">thereum via CCTP. The mechanics, chains, and timelines are distinct.<\/span><\/p>\n<p><span style=\"font-weight:400\">Anyone holding rsETH or related positions on Aave, Compound, or other lending markets was being advised by community members to review exposure while the situation remained unresolved.<\/span><\/p>\n<p><span style=\"font-weight:400\">The six attacker wallets identified by ZachXBT remain active targets for onchain tracing as analysts work to map where the funds moved after leaving Aave. <\/span><\/p>\n<p><em><span style=\"font-weight:400\">Editor\u2019s note: This article was updated to note that the issue was <a href=\"https:\/\/x.com\/cryptounfolded\/status\/2045584006620627005?s=20\" target=\"_blank\" rel=\"noopener noreferrer\">reported<\/a> as bridge exploit. <\/span><\/em><\/p>\n<\/div>\n<p><a href=\"https:\/\/news.bitcoin.com\/zachxbt-flags-280m-kelpdao-exploit-hitting-ethereum-defi-lending-markets\/\">Source link <\/a><br \/>\n<br \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>(Originally posted on : Bitcoin News ) Key Takeaways: ZachXBT flagged a $280M+ theft across Ethereum and Arbitrum DeFi protocols on April 18, 2026. KelpDAO\u2019s bridge exploit created bad debt on Aave V3, with AAVE token dropping roughly 10-13%. KelpDAO has not confirmed the exploit; analysts are monitoring six identified attacker wallets for recovery clues. [&hellip;]<\/p>\n","protected":false},"author":19,"featured_media":71334,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0},"categories":[32],"tags":[],"_links":{"self":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/71333"}],"collection":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/users\/19"}],"replies":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/comments?post=71333"}],"version-history":[{"count":0,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/posts\/71333\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media\/71334"}],"wp:attachment":[{"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/media?parent=71333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/categories?post=71333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/crowdfundjunction.com\/blog\/wp-json\/wp\/v2\/tags?post=71333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}