Kelp DAO, a decentralized finance liquid staking protocol, suffered a $292 million exploit on Friday, making it the largest cryptocurrency hack of 2026 and one of the most significant DeFi security breaches in history. The attack compromised the protocol's wrapped ether (wETH) reserves, leaving approximately $85 million in assets temporarily frozen across 20 different blockchain networks.
Market Context
The exploit occurs amid heightened scrutiny of cross-chain DeFi protocols following a series of bridge hacks in recent quarters. The total value locked across DeFi protocols exceeded $180 billion at the week's peak, with liquid staking derivatives representing roughly 15% of that figure. Bitcoin held steady around $67,500 during the incident, while ether dipped 2.3% to $3,420 in early Saturday trading as the news spread across crypto markets.
Analysis
Blockchain investigators at Arkham Intelligence and Chainalysis traced the exploit to a vulnerability in Kelp DAO's cross-chain bridging mechanism, which allowed the attacker to mint wrapped tokens on destination chains without proper validation of the underlying collateral. The attacker leveraged a flash loan to manipulate price oracles before executing the exploit, a technique that has become increasingly common in DeFi hacks. Kelp DAO's governance token, KELP, dropped 45% within hours of the exploit being disclosed. The protocol has since paused all deposits and withdrawals while working with law enforcement and security firms to trace the stolen funds.
Key Numbers
- $292 million total value exploited from Kelp DAO's liquidity pools
- $85 million in wrapped assets currently frozen across 20 blockchain networks
- 45% drop in KELP governance token price following the exploit disclosure
- 20 separate blockchain networks affected by stranded wrapped ether
- Approximately $180 billion in total value locked across DeFi protocols at week's peak
What to Watch
Kelp DAO has announced a 20% whitehat bounty for the return of frozen assets, though no communication from the attacker has been confirmed. The team is coordinating with law enforcement agencies in multiple jurisdictions. Cross-chain bridge security standards are expected to face renewed regulatory attention following what is now the largest single-protocol exploit in DeFi history. Traders should monitor ether liquidity flows and potential contagion effects on other liquid staking protocols.
Sources
The information was confirmed through on-chain data from Etherscan and Dune Analytics, with additional reporting from CoinDesk's coverage of the incident. Kelp DAO issued an official statement on social media confirming the exploit and bounty offer.
Bottom Line
The Kelp DAO exploit underscores persistent vulnerabilities in cross-chain DeFi infrastructure and may trigger a broader repricing of risk across liquid staking protocols until significant security upgrades are implemented.