A cross-chain bridge, collapsing two protocols, $292 million gone in an instant.


The full process of the KelpDAO theft:
→ Hackers exploited a 1/1 DVN configuration vulnerability in the LayerZero cross-chain bridge
→ Illegally minted 116,500 rsETH (worth $292 million)
→ Used fake rsETH to borrow $196 million in real funds on Aave
→ Aave experienced bad debt, with AAVE plummeting 18% in a single day
→ Whale panic-sold 59,000 AAVE tokens
The biggest DeFi hack of 2026 wasn’t due to highly advanced hacking skills, but because—
The security configuration of the cross-chain bridge was surprisingly only a 1/1 multi-signature.
One line of defense, one signature, $292 million.
You think you can earn passively in DeFi, but hackers understand your money better than you do.
Three lessons:
1/ The security of wrapped assets will always lag behind native assets by one layer
2/ Cross-chain trust is the most fragile link in DeFi, bar none
3/ The more nested the protocols, the worse the fallout when things blow up
Don’t put all your eggs in one protocol.
Especially avoid nested wrapped assets.
Only those who respect the risks can survive the bull market.
ZRO3.57%
AAVE-3.73%
View Original
This page may contain third-party content, which is provided for information purposes only (not representations/warranties) and should not be considered as an endorsement of its views by Gate, nor as financial or professional advice. See Disclaimer for details.
  • Reward
  • Comment
  • Repost
  • Share
Comment
Add a comment
Add a comment
No comments
  • Pin