KelpDAO Hack Explained: $293 Million Exploit Sends DeFi TVL Crashing Across Chains

KelpDAO, one of the largest liquid restaking protocols in decentralized finance, lost more than $293 million in an exploit over the weekend of October 24, 2026, after an attacker compromised its bridge contract. Within hours, the fallout spread far beyond KelpDAO itself: total value locked (TVL) plummeted across nearly every major blockchain, Ethereum shed close to 11% of its TVL in a single day, and at least 126 of DeFiLlama's tracked networks printed red 24-hour changes. The incident is the worst security breach the DeFi space has seen so far in 2026 — and it landed in the middle of what was already one of the darkest weeks for crypto security in years.

Here is the full breakdown: how the exploit worked, who is behind it, exactly how bad the TVL crash has been across chains, why a single protocol hack rattled the entire DeFi ecosystem, and what it all means for regular crypto users. If you are still finding your footing in the space, our beginner's guide to DeFi in 2026 explains the building blocks — like TVL, liquid restaking, and bridges — that this story revolves around.

What Happened: The $293 Million KelpDAO Bridge Exploit

KelpDAO is a liquid restaking protocol: users deposit ETH or liquid staking tokens (LSTs) into it, earn regular staking yield, and additionally earn restaking rewards by allowing their staked assets to secure other networks and services at the same time. The protocol grew into one of the sector's heaviest hitters, which is precisely what made it such an attractive target.

Over the weekend of October 24, 2026, an attacker exploited KelpDAO's bridge contract — the piece of infrastructure that moves assets between blockchains — and drained more than $293 million. Bridge contracts are among the most sensitive components in DeFi because they routinely hold enormous pools of user assets awaiting transfer between chains; a single vulnerability in the verification logic can hand an attacker the keys to the vault. Once the exploit was executed, the funds were siphoned away from the protocol, and the race to track, freeze, or recover them began.

The timing compounded the damage. The exploit did not land in a calm market. It struck as crypto markets were already absorbing the shocks of several other major security incidents from the same week — a cluster that pushed fear across the entire DeFi landscape and triggered the broad TVL flight documented below.

For anyone trying to understand why bridges keep failing, the pattern is depressingly consistent: bridges concentrate enormous value in a small number of smart contracts, and history shows attackers return to that honey pot again and again. This weekend's incident is the largest data point in that trend so far this year.

The Lazarus Group's TraderTraitor Unit: Who's Behind It

LayerZero has since attributed the attack to the Lazarus Group's TraderTraitor unit, the North Korean-linked cyber operations division responsible for some of the largest crypto thefts in history. The TraderTraitor unit is known for targeting crypto projects through social-engineering campaigns, malicious job offers, and compromised personnel — often combined with deep technical exploitation of the target's infrastructure.

The attribution matters because of the scale of what North Korea-linked groups have taken. Attacks tied to these groups in 2026 alone had already exceeded $300 million before the KelpDAO incident, making this weekend's exploit roughly the 18th such attack this year. In recent years, the total estimated amount stolen by North Korea-linked groups has surpassed $6.5 billion — a figure that has drawn sanctions, indictments, and a sustained international law-enforcement response, yet the campaigns continue.

What makes these groups so dangerous to DeFi specifically is their combination of patience and technical sophistication. Where opportunistic hackers probe for known vulnerabilities, state-linked units have been observed running months-long campaigns against a target: compromising private keys, infiltrating development teams, and laundering proceeds through sophisticated multi-step chains designed to defeat blockchain analytics. That profile fits the severity and precision of the KelpDAO bridge exploit.

The attribution also complicates recovery. Funds stolen by the Lazarus Group are typically moved through mixers and layered across chains with professional laundering infrastructure, and only a fraction of their historical thefts has ever been recovered or frozen. More on the money-laundering trail in the Drift section below — because this same week's events show exactly how that playbook unfolds in real time.

DeFi TVL Collapse: The Contagion Across Chains

The most visible consequence of the KelpDAO exploit was not the protocol's own losses — it was the chain-wide TVL crash that followed. DeFiLlama data shows at least 126 of its tracked networks in the red over a 24-hour window as capital fled DeFi broadly. As analyst "Vet" wrote on X: "Money is exiting," and investors are now "repricing the risk/reward" of parking funds in DeFi protocols.

The numbers across the major chains are stark:

Chain / Network	TVL Change (24h)	Notes
Ethereum	-~11%	The largest drop among top chains by magnitude
Hyperliquid	-12% (to $1.44B)	Sharpest percentage fall in the top 10
Arbitrum	-9.97%	Flagged as exposed to bad debt post-hack
Base	-5.76%	Flagged as exposed to bad debt post-hack
Avalanche	-6.61%	Steady bleed across the ecosystem
Solana	-4%+	-19.06% over the past month
Bitcoin / Tron / BSC	-1.6% or less	Comparatively resilient

Outside the top 10, the pain was even more concentrated. Mantle's TVL collapsed by 42% — and DeFiLlama co-founder 0xngmi specifically flagged it as among the most exposed to bad debt after the hack, alongside Base and Arbitrum. Taiko fell 22%, Berachain dropped 17%, and Monad lost 13.21%. In one of the most extreme cases, CosmoHub lost over 1,500% of its TVL, effectively wiping the network's DeFi footprint.

Not every chain bled. A handful of networks printed green: Q Protocol surged 477%, Oasys gained 90.6%, and Shibarium rose 85% — likely reflecting capital rotation into smaller, less-exposed ecosystems rather than any fundamental news on those chains.

Two dynamics are driving the numbers. First, genuine withdrawals: users are pulling funds from protocols out of fear of contagion, especially from anything connected to restaking, bridging, or the KelpDAO ecosystem. Second, price effects: TVL is measured in dollar terms, so the market selloff that accompanied the exploit mechanically shrinks TVL even where no user withdrew a cent. Together, they produced one of the sharpest single-day DeFi contractions of the year.

Why One Hack Rattled All of DeFi

The obvious question: why would an exploit at one restaking protocol erase double-digit percentages of TVL on chains that had nothing to do with it? The answer is that DeFi is far more interconnected — and fragile — than its decentralization branding suggests.

Composability is a double-edged sword. DeFi protocols are built to plug into each other: restaked assets get deposited into lending markets, lending receipts flow into liquidity pools, pool tokens collateralize other positions. When the base layer of that stack — like KelpDAO's restaked tokens — is compromised, everything built on top of it reprices at once. Traders and funds holding derivative positions unwind them preemptively, and the unwinding cascades.

Bridges are systemic risk points. The exploit targeted a bridge contract, and bridges are the arteries of multi-chain DeFi. A compromised bridge doesn't just endanger one protocol — it endangers every chain and application that accepted the bridge's wrapped assets as legitimate. Confidence in bridged asset backing wobbles, and capital retreats to native assets and centralized venues.

Liquid restaking concentrates risk by design. KelpDAO's model — one deposit earning yield across many services — means a single protocol failure touches many downstream integrations simultaneously. The restaking sector has been DeFi's fastest-growing segment in 2026, and this exploit is its first true stress test. The market's verdict, at least for now, is a risk premium: money is demanding higher compensation to stay in restaking, or it is leaving.

Bad debt fears amplify everything. When a protocol loses hundreds of millions, lending markets connected to it face the risk of undercollateralized positions — bad debt. That is why 0xngmi's flag on Mantle, Base, and Arbitrum mattered: it named the networks where the bad-debt overhang could be largest, and the market priced it in within hours. For a deeper explanation of how DeFi's core mechanics work, see our beginner's guide to DeFi.

None of this is new in principle — every major DeFi exploit since 2022 has produced some version of this contagion. What is new is the scale, and the fact that it arrived in a week already saturated with security failures, leaving the market with no buffer of confidence to absorb it.

A Brutal Week for DeFi Security

The KelpDAO exploit did not happen in isolation. It was the exclamation point on one of the worst security weeks in DeFi history:

• Drift Protocol lost roughly $286 million on Solana after attackers drained its JLP Delta Neutral and SOL/BTC Super Staking vaults, including about 41.7 million JLP in a single transaction. Blockchain analytics firm Elliptic says the attack may be North Korea-linked, citing on-chain movements and laundering methods, while security firm PeckShield blamed an admin private-key compromise. The suspected Drift exploiter has since moved around 44,510 ETH — roughly $109 million — to the Tornado Cash mixer, and nearly $194 million remains under the attacker's control, according to reporting on the unfolding case. Our full breakdown of the incident is in the Drift hack tracker.
• Initia halted its layer-1 blockchain and rollups after an exploit minted 2 million AUSD without backing, draining an estimated $2.6–2.73 million. Independent researcher Spreek first flagged the suspicious activity before security teams confirmed it, and D2 Finance later detailed the Move-function vulnerability behind the attack. The chain was halted at 3:41 p.m. UTC on Friday, as covered by Cointelegraph.
• Injective froze block production for roughly 4 hours to stop a hack worth about $4.9 million — a drastic emergency measure for a layer-1 chain, and one the team initially described in upgrade language, per coverage of the freeze.
• Yearn Finance suffered a $9 million hack earlier via the so-called "16 wei" exploit, as detailed in our explainer on the Yearn incident.

Add it up: well over $590 million drained from DeFi protocols in a single week, across Ethereum, Solana, Cosmos-ecosystem chains, and Injective — spanning bridges, perpetuals platforms, lending vaults, and stablecoin infrastructure. No single attack vector, no single chain, no single team failure. It was a sector-wide stress test, and the TVL data shows the market noticed.

What This Means for Your Crypto

If you hold crypto — whether in DeFi protocols or on exchanges — here is a calm, practical read of the situation:

• Your exchange funds are not directly affected. This was a DeFi protocol exploit, not an exchange breach. Assets sitting on major centralized exchanges were untouched by the KelpDAO attack itself — though market prices fell across the board.
• Check your exposure to restaking and bridges. If you deposited into KelpDAO or into protocols built on top of KelpDAO's restaked assets, review official announcements from those projects before taking action. Do not panic-withdraw into scam links — phishing campaigns spike after major hacks.
• Expect volatility, not necessarily doom. DeFi has survived larger relative drawdowns. The TVL crash reflects fear and price effects as much as real losses. Protocols with no connection to the exploit are still functioning normally.
• Use this as a security audit of your own setup. Hardware wallets, unique passwords, skepticism toward unsolicited messages, and keeping most holdings off experimental protocols are evergreen defenses. Our guide to protecting your crypto from hacks and scams walks through the full checklist — it is worth revisiting after a week like this one.
• Watch for the phishing wave. After every nine-figure exploit, scammers impersonate the hacked protocol with fake "refund" or "migration" sites. KelpDAO will never ask for your seed phrase. Verify every link through official channels.

This is not financial advice — it is operational hygiene. Nobody can tell you whether to buy, sell, or hold through the fallout, but everyone can reduce their exposure to the attack vectors that keep working: compromised bridges, over-concentrated protocol risk, and social engineering.

What's Next: Recovery, Regulation, and What to Watch

The immediate question is recovery: how much of the $293 million can be traced, frozen, or returned. Given the Lazarus Group attribution, expectations should be measured — North Korea-linked groups run professional laundering operations, and the Drift case this same week shows the playbook in action, with nine figures already routed through Tornado Cash. Blockchain investigators, exchanges, and stablecoin issuers will be watching the attacker's wallets, and any movement to centralized off-ramps creates a seizure opportunity.

The second question is contagion containment. The networks flagged for bad-debt exposure — Mantle, Base, Arbitrum — will be under scrutiny in the coming days as lending positions settle and liquidations process. If bad debt materializes at scale on any of them, expect a second wave of TVL flight. If it doesn't, the current drawdown may partially reverse as fear subsides.

The third question is structural. A $293 million bridge exploit, in a week with $590 million-plus in total DeFi losses, will intensify several conversations already underway:

• Bridge security standards: expect renewed pressure for formal verification, bug-bounty scale-ups, and circuit breakers on high-value bridge contracts.
• Restaking risk disclosure: liquid restaking's promise — one deposit, many yields — now has its largest-ever cautionary tale. Regulators and auditors will be asking harder questions about how restaking risk is communicated to depositors.
• North Korea enforcement: with 2026's North Korea-linked thefts now well past $300 million across roughly 18 attacks, expect further sanctions designations and mixer-focused enforcement actions.
• Chain-level emergency powers: Initia's chain halt and Injective's 4-hour block freeze reopen the debate about how "decentralized" emergency responses really are — and whether users accept that tradeoff.

Watch three things in the coming week: official post-mortems from KelpDAO (the technical details of the bridge vulnerability), any fund-freezing announcements from exchanges or stablecoin issuers, and whether the TVL bleed stabilizes or deepens on the flagged chains. The exploit is over; the repricing it triggered is just beginning.

Frequently Asked Questions

What is the KelpDAO hack?

Over the weekend of October 24, 2026, an attacker exploited KelpDAO's bridge contract and drained more than $293 million from the liquid restaking protocol. LayerZero attributed the attack to the Lazarus Group's TraderTraitor unit. It is the worst DeFi security breach of 2026 so far.

How much TVL did DeFi lose after the KelpDAO exploit?

DeFiLlama data shows at least 126 tracked networks in the red over 24 hours. Ethereum's TVL fell nearly 11%, Solana dropped just over 4% (down 19.06% over a month), Hyperliquid fell 12% to $1.44 billion, Arbitrum lost 9.97%, Base 5.76%, and Avalanche 6.61%. Mantle collapsed 42%, Taiko 22%, Berachain 17%, and Monad 13.21%. Bitcoin, Tron, and BSC each lost 1.6% or less.

Who is behind the KelpDAO hack?

According to LayerZero's attribution, the attack was carried out by the TraderTraitor unit of North Korea's Lazarus Group. North Korea-linked groups have now been tied to roughly 18 crypto attacks in 2026 alone, stealing more than $300 million this year — and over $6.5 billion in recent years.

Is my crypto safe after the KelpDAO exploit?

Funds on major centralized exchanges were not directly affected. If you used KelpDAO or protocols built on its restaked assets, follow official project announcements. For everyone else, the main risks are market volatility and the phishing scams that follow major hacks — never share your seed phrase, and verify links through official channels. See our crypto security guide for the full protection checklist.

What is liquid restaking, and why was KelpDAO a target?

Liquid restaking lets users deposit ETH or liquid staking tokens to earn staking yield plus additional rewards for securing other networks simultaneously. KelpDAO grew into one of the largest protocols in the sector, concentrating enormous value in its contracts — and its bridge contract, which held large pools of assets moving between chains, became a prime target. Big pools of user funds in a single contract are exactly what sophisticated attackers hunt.

Will DeFi recover from this TVL crash?

DeFi has recovered from steep drawdowns before, and part of the current TVL drop is price effects rather than real withdrawals. Recovery depends on three things: whether bad debt materializes on the flagged chains (Mantle, Base, Arbitrum), whether any stolen funds are frozen or recovered, and whether the market regains confidence in bridge and restaking infrastructure. Expect volatility in the near term regardless.

Conclusion

The KelpDAO exploit — more than $293 million drained through a bridge contract, attributed to North Korea's TraderTraitor unit — is the worst DeFi hack of 2026, and it detonated in the middle of a week that had already seen Drift lose $286 million, Initia halt its chain, and Injective freeze block production. The result was a sector-wide repricing: 126 networks in the red, Ethereum down nearly 11% in TVL, and smaller chains like Mantle losing over 40%.

The deeper story is structural. DeFi's composability means a failure at one heavily-integrated protocol cascades everywhere; bridges remain the system's most concentrated points of failure; and liquid restaking — the sector's great growth engine of 2026 — just endured its harshest stress test. As analyst Vet put it, money is exiting while the market reprices risk and reward.

For users, the playbook hasn't changed: keep holdings on battle-tested venues, treat unaudited yield as risk rather than income, and assume every major hack will be followed by a wave of phishing. For the industry, the bill is coming due on bridge security, restaking risk disclosure, and the North Korean campaigns that have now taken well over $300 million this year alone. The exploit took a weekend. The reckoning will take much longer.