# Hack Related Articles

HTX News Center provides the latest articles and in-depth analysis on "Hack", covering market trends, project updates, tech developments, and regulatory policies in the crypto industry.

$292 Million KelpDAO Cross-Chain Bridge Hack: Who Should Foot the Bill?

On April 18, 2026, an attacker stole 116,500 rsETH (worth ~$292M) from KelpDAO’s cross-chain bridge in 46 minutes—the largest DeFi exploit of 2026. The stolen assets were deposited into Aave V3 as collateral, causing $177–200M in bad debt and triggering a cascade of losses across nine DeFi protocols. Aave’s TVL dropped by ~$6B overnight. This legal analysis argues that KelpDAO and LayerZero Labs share concurrent liability, with fault apportioned 60%/40%. KelpDAO negligently configured its bridge with a 1-of-1 decentralized verifier network (DVN)—a single point of failure—despite LayerZero’s explicit recommendation of a 2-of-3 setup. LayerZero, which operated the compromised DVN, failed to secure its RPC infrastructure against a known poisoning attack vector. Both protocols’ terms of service cap liability at $200 (KelpDAO) or $50 (LayerZero), but these limits are likely unenforceable due to unconscionability, gross negligence exceptions, and potential securities law invalidation (if rsETH is deemed a security under the Howey test). Aave’s governance also faces fiduciary duty claims for raising rsETH’s loan-to-value ratio to 93%—far above competitors’ 72–75%—without adequately assessing bridge risks, amplifying the systemic fallout. Practical recovery targets include LayerZero Labs (a registered Canadian entity), KelpDAO’s founders, auditors, and identifiable Aave governance delegates. The incident underscores escalating legal risks for DeFi protocols, infrastructure providers, and governance participants.

marsbit04/24 06:25

$292 Million KelpDAO Cross-Chain Bridge Hack: Who Should Foot the Bill?

marsbit04/24 06:25

Aave Is Surrendering the Throne of DeFi Lending Due to Its Own Stupidity

An article titled "Aave Is Giving Up Its Throne in DeFi Lending Due to Its Own Foolishness" discusses how Aave mishandled a crisis following a $292 million hack of rsETH from Kelp DAO, leading to significant outflows and reputational damage. After the hack, Aave failed to promptly reassure users or commit to covering potential bad debt—estimated between $123.7 million and $230.1 million—despite having sufficient reserves. This hesitation triggered panic, resulting in $17.2 billion in outflows and liquidity crises across multiple pools. The author argues that Aave’s poor crisis management and reluctance to act quickly exacerbated the situation, damaging its reputation as the "safest DeFi" platform. Meanwhile, competitor Spark, a fork of Aave V3, capitalized on the situation by attracting fleeing funds, growing its TVL by nearly $2 billion. Spark had previously delisted rsETH, avoiding any exposure to the hack. Its proactive communication and strategic positioning contrast sharply with Aave’s delayed response. Although Aave’s founder later announced a relief plan (DeFi United) with multiple partners and a personal donation, the damage to user trust and liquidity may be lasting. The article concludes that Aave’s missteps have allowed competitors like Spark, Morpho, and Jupiter Lend to challenge its dominant position in DeFi lending.

marsbit04/24 02:40

Aave Is Surrendering the Throne of DeFi Lending Due to Its Own Stupidity

marsbit04/24 02:40

Aave Is Surrendering the Throne of DeFi Lending Due to Its Own Stupidity

Aave, a leading DeFi lending protocol, is facing a severe crisis and losing its dominant market position due to its poor handling of a recent security incident. The crisis began when Kelp DAO suffered a hack resulting in a loss of $292 million in rsETH. In the aftermath, approximately $17.2 billion in funds flowed out of Aave as user panic escalated. The article criticizes Aave's crisis management as "extremely foolish." Instead of promptly offering reassurance or committing to cover the potential bad debt—estimated between $123.7 million and $230.1 million, which Aave could have afforded—the protocol initially deflected blame, emphasizing that its code was not at fault. This delay and lack of a clear guarantee led to widespread user anxiety, triggering a bank run-like scenario where users withdrew funds or borrowed aggressively from other pools, causing liquidity shortages. Meanwhile, Aave’s competitor Spark—a fork of Aave’s own code—has benefited significantly. Having removed support for rsETH months earlier, Spark avoided any losses from the incident and has since seen its TVL grow by nearly $2 billion, attracting major deposits such as over $1.24 billion from Justin Sun. Spark has actively capitalized on the situation, publicly criticizing Aave’s security reputation. Although Aave’s founder Stani eventually announced a relief plan named "DeFi United" with several partners and a personal donation, the damage to user trust and capital outflows may be irreversible. The article concludes that Aave is losing its throne in DeFi lending to aggressive competitors like Spark, Morpho, and Jupiter Lend.

Odaily星球日报04/24 02:38

Aave Is Surrendering the Throne of DeFi Lending Due to Its Own Stupidity

Odaily星球日报04/24 02:38

Cardano Founder Warns KelpDAO Hack Exposes Ethereum’s Weakest Link

Cardano founder Charles Hoskinson argues that the $292 million KelpDAO exploit reveals a critical systemic flaw in Ethereum's DeFi ecosystem, rather than just a simple bridge failure. He emphasizes that the core issue was not a smart contract vulnerability, but a failure in cross-chain message verification. Specifically, a single-verifier setup allowed a forged message to be accepted, leading to the theft of 116,500 rsETH. Hoskinson warns that the attack’s true danger emerged when the stolen assets were used as collateral in lending markets, creating widespread bad debt contagion and triggering a liquidity crisis that caused up to $13 billion in withdrawals across multiple protocols. He calls for a broader industry discussion on bridge security and verifier design to prevent similar systemic risks.

bitcoinist04/22 06:33

Cardano Founder Warns KelpDAO Hack Exposes Ethereum’s Weakest Link

bitcoinist04/22 06:33

DeFi Falls into the Most Dangerous Prisoner's Dilemma in History

ChainCatcher author Gu Yu analyzes the severe fallout from the Kelp DAO exploit, which has triggered a crisis of confidence across the DeFi ecosystem, implicating major projects like Aave, LayerZero, and Arbitrum. The attack, attributed to the Lazarus Group, exploited a single-validator (1/1) configuration in LayerZero’s decentralized verification network (DVN), leading to over $40M in losses. LayerZero’s official report claimed its protocol “operated as expected” and deflected blame onto Kelp DAO’s configuration choices, sparking backlash from developers and researchers who criticized its avoidance of responsibility. Meanwhile, Arbitrum’s security committee intervened by using a privileged transaction to freeze and recover ~30,766 ETH ($71M) from the hacker’s address—a move praised for pragmatism but criticized for undermining Layer2 decentralization ideals. The incident has intensified debates on cross-chain bridge security, Layer2 centralization risks, and the tension between practical security measures and decentralized principles. With Aave facing ~$200M in bad debt and no clear compensation plan from Kelp DAO or LayerZero, the situation reflects a dangerous “prisoner’s dilemma” where key players prioritize self-interest over collective trust, threatening foundational DeFi narratives.

marsbit04/21 12:41

DeFi Falls into the Most Dangerous Prisoner's Dilemma in History

marsbit04/21 12:41

Bitcoin Price Approaches $78K Amid Ongoing Bullish Momentum

Bitcoin's price is currently trading between $74,000 and $78,000, showing strong bullish momentum after recovering from a drop to $68,000 earlier this month. The cryptocurrency recently surged to $77,985, driven by increased institutional holdings and positive market sentiment fueled by scheduled US-Iran peace talks. While Bitcoin gains strength, altcoins like Ether lag due to investor caution following a $290 million hack on KelpDAO. Market dynamics remain balanced between buyers and sellers, with geopolitical events and oil prices influencing risk asset movements. The current tight trading range suggests a potential directional shift ahead.

TheNewsCrypto04/21 11:30

Bitcoin Price Approaches $78K Amid Ongoing Bullish Momentum

TheNewsCrypto04/21 11:30

Six Years Since DeFi Summer, How Will the Decentralized Financial Revolution Continue?

In 2026, the DeFi sector faces a severe trust crisis following a series of high-profile security breaches, including a $292 million theft from KelpDAO’s rsETH, a $2.85 million exploit at Drift Protocol due to permission vulnerabilities, and a $14.9 million lending failure at Venus Protocol. These incidents triggered a withdrawal of approximately $10 billion from DeFi over a single weekend, highlighting systemic risks beyond smart contract flaws—such as governance, cross-chain complexity, and operational weaknesses. Despite these challenges, on-chain finance continues to grow, with capital shifting toward safer, regulated products. Stablecoins like USDT ($185B) and USDC ($78B) have reached a combined market cap of $263 billion, while tokenized U.S. Treasuries surged to $10.93 billion. Visa’s growing USDC settlement volume, now annualized at $3.5 billion, signals increasing institutional adoption of compliant blockchain-based financial infrastructure. The competition for the future of on-chain finance is intensifying. While native DeFi struggles with trust and capital outflows, regulated products—stablecoins, tokenized assets, and ETFs—are gaining dominance by offering programmable, 24/7 settlement without high DeFi risks. Over 80 crypto projects shut down in Q1 2026, reflecting dwindling patience for speculative ventures. The core challenge for open DeFi is to rebuild trust and demonstrate irreplaceable value—or risk ceding its role as the primary entry point to on-chain finance.

marsbit04/21 09:10

Six Years Since DeFi Summer, How Will the Decentralized Financial Revolution Continue?

marsbit04/21 09:10

Arbitrum Freezes $71M ETH Linked to Kelp Hack, Sparks Decentralization Debate

Arbitrum, an Ethereum layer-2 blockchain, froze 30,766 ETH (worth over $71.2 million) linked to the recent Kelp protocol exploit. The freeze was executed by a 12-member security council appointed by the Arbitrum community, moving the funds to an intermediary wallet accessible only through further governance action. The hack, which occurred on Saturday, resulted in at least $293 million in losses and was attributed to North Korea by LayerZero. The incident has reignited debates about decentralization, as some critics argue such freezes contradict blockchain’s core principles, while others support them for security. The council reportedly spent hours deliberating the decision, which was approved by 9 of its 12 members.

TheNewsCrypto04/21 09:05

Arbitrum Freezes $71M ETH Linked to Kelp Hack, Sparks Decentralization Debate

TheNewsCrypto04/21 09:05

Arbitrum Pretends to Be the Hacker, 'Steals' Back the Money Lost by KelpDAO

Title: Arbitrum Poses as Hacker to Recover Stolen Funds from KelpDAO Last week, KelpDAO suffered a hack resulting in nearly $300 million in losses, marking the largest DeFi security incident this year. Approximately 30,765 ETH (worth over $70 million) remained on an Arbitrum address controlled by the attacker. In an unprecedented move, Arbitrum’s Security Council utilized its emergency authority to upgrade the Inbox bridge contract, adding a function that allowed them to impersonate the hacker’s address and initiate a transfer without access to its private key. The council’s action, approved by 9 of its 12 members, moved the stolen ETH to a frozen address in a single transaction before reverting the contract to its original state. The operation was coordinated with law enforcement, which attributed the attack to North Korea’s Lazarus Group. Community reactions are divided: some praise the recovery of funds, while others question the centralization of power, as the council can upgrade core contracts without governance votes. However, such emergency mechanisms are common among major L2s. Despite the partial recovery, over $292 million was stolen in total, with more than $100 million in bad debt on Aave and remaining funds scattered across other chains. The incident highlights escalating security challenges in DeFi, with state-sponsored hackers employing advanced tactics and L2s responding with elevated countermeasures.

marsbit04/21 07:59

Arbitrum Pretends to Be the Hacker, 'Steals' Back the Money Lost by KelpDAO

marsbit04/21 07:59

The $290 Million Deficit: A Three-Way Game Between Aave, L0, and Kelp—Who Should Foot the Bill?

An incident involving the theft of 116,500 rsETH (worth approximately $290 million) from Kelp DAO’s cross-chain bridge contract has triggered a complex dispute over responsibility and compensation among Kelp DAO, LayerZero, and Aave. The attack occurred due to a compromised RPC provider used by LayerZero’s Decentralized Verifier Network (DVN). Since Kelp DAO’s bridge used a 1/1 DVN configuration—a single point of failure—the attacker successfully forged a cross-chain message, leading to the unauthorized release of rsETH tokens from the mainnet. These genuine tokens were then deposited into Aave and other lending platforms to borrow WETH, enabling the attacker to exit with the funds. Responsibility is attributed primarily to Kelp DAO for its risky 1/1 DVN setup. LayerZero bears secondary responsibility for permitting such a vulnerable configuration in its protocol layer. Aave also shares indirect blame for over-collateralizing rsETH and other Liquid Restaking Token (LRT) assets without adequate ongoing risk oversight. Kelp DAO lacks sufficient funds to cover the loss, shifting focus to the deeper-pocketed players: LayerZero, whose cross-chain ecosystem and reputation are at risk, and Aave, which faces massive bad loans and declining Total Value Locked (TVL). Aave has asserted that mainnet rsETH remains fully backed, implying it expects Kelp DAO to allow redemption of underlying ETH. This approach would preserve Aave’s mainnet positions but invalidate Layer2 rsETH, damaging LayerZero’s cross-chain credibility. Potential solutions include: - A universal 18.5% haircut on all rsETH holders, causing significant Aave bad debt. - Writing off Layer2 rsETH entirely, protecting Aave mainnet but harming LayerZero and Kelp DAO. - Negotiating a bounty with the hacker for partial fund return. - A joint bailout, possibly led by LayerZero’s ecosystem fund, given its long-term stake in the cross-chain ecosystem. The situation remains unresolved as the parties negotiate, but prolonged delay risks broader DeFi instability, including potential liquidity crises and loss of confidence in LRT and cross-chain infrastructures.

Odaily星球日报04/20 08:52

The $290 Million Deficit: A Three-Way Game Between Aave, L0, and Kelp—Who Should Foot the Bill?

Odaily星球日报04/20 08:52

活动图片

Hot Categoriesright-arrow

Hot Tagsright-arrow

Project Updatesright-arrow

Ethereumright-arrow