The weekend of April 18, 2026, will go down in DeFi history. In just 46 minutes<\/strong>, an attacker drained 116,500 rsETH<\/strong> from KelpDAO’s LayerZero bridge, making off with the equivalent of $292 million<\/strong>. The mechanics of the exploit were incredibly simple: a fake verification attestation tricked the cross chain messaging system, allowing the bridge’s reserves to be released without any real counterpart. The stolen funds were immediately routed through Tornado Cash. This is the largest DeFi hack of 2026, surpassing the $285 million<\/strong> stolen from Drift Protocol in early April, and bringing total crypto losses to over $600 million<\/strong> in the past two weeks.<\/p>\n\n\n\n The contagion was immediate. Aave froze its rsETH markets on V3 and V4, with its token<\/a> AAVE<\/a> plunging by over 20%<\/strong> in a matter of hours. LayerZero (ZRO) dropped 22%<\/strong> in 24 hours. SparkLend, Fluid, and Ethena followed suit with suspensions. Meanwhile, users withdrew $10 billion<\/strong> in liquidity from the DeFi market, creating bank run optics that the space had not seen in months. To understand why this type of exploit spreads so quickly across the ecosystem, our guide on understanding cryptocurrencies explains the mechanics of DeFi composability.<\/p>\n\n\n\n