Hack history / 2026 / Hack or exploit
Kelp
Hack or exploit on Apr 18, 2026 · Cross-Chain Message Spoofing
SOURCES AGREE ON DATE AND LOSS · 4 SOURCES
Lost
$293M
dollars at the time
Returned
none listed
as the sources state it
Rank
#19
among thefts by dollars lost
What happened
On April 18, 2026, Kelp DAO's rsETH bridge was exploited for $293 million when attackers compromised LayerZero's RPC nodes via social engineering and injected fraudulent cross-chain messages. Kelp's 1-of-1 verifier configuration created a single point of failure, affecting validation across 20 chains. The attack was attributed to Lazarus Group.
Details
- Date
- Apr 18, 2026
- Kind
- Hack or exploit
- Method
- Cross-Chain Message Spoofing
- How in
- Bridge and cross-chain
- Target
- DeFi protocol
- Chains
- Ethereum, Arbitrum
Related incidents
Kelp DAO 2024 · Hack or exploit · undisclosed
CrossCurve 2026 · Hack or exploit · $3M
zkLink Nova 2026 · Hack or exploit · $783K
Demex Perp 2026 · Hack or exploit · $192K
CrossCurve 2026 · Hack or exploit · $3M
zkLink Nova 2026 · Hack or exploit · $783K
Demex Perp 2026 · Hack or exploit · $192K
Cite this page
SwanBluechip, "Kelp hack, Apr 18, 2026: $293M lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht00074fb232/ (data as of 2026-10-31).