Author: GoMoon
The biggest DeFi hack of early 2026 is here! On April 18th, Kelp DAO's liquid restaking protocol fell victim, with hackers draining 116,500 rsETH in just a few hours, amounting to a staggering $293 million at the time.
Security researchers confirmed that Kelp DAO's smart contract code had no vulnerabilities. This $293 million loss wasn't due to faulty code, but was hidden in an overlooked "configuration parameter," making it the year's biggest security lesson!
How did the hacker pull it off?
The attack process was unusually smooth, executed by the hacker in just three steps:
1. Exploited a configuration loophole to forge messages: Kelp DAO used the LayerZero cross-chain bridge, which has a key configuration called the DVN threshold. It was set to "1-of-1"—meaning only one validator node needed to confirm a cross-chain message. The hacker compromised this sole node, forged fake messages, and tricked the Ethereum mainnet into minting rsETH not backed by actual assets.
2. Collateralized and cashed out for real assets: Using these fake rsETH tokens, the hacker dispersed them as collateral across three lending protocols—Aave V3, Compound V3, and Euler—borrowing over $236 million worth of WETH (real, stable assets) in one go.
3. Swift exit and market lock: The hacker swiftly withdrew with the $236 million in WETH, leaving chaos behind. Platforms like Aave and SparkLend hurriedly froze the rsETH market. Aave V3 alone faced approximately $177 million in bad debt, a loss ultimately borne by users who had staked aWETH.
The most alarming takeaway isn't the hacker's sophistication, but the exposure of a "structural blind spot" in DeFi security—configuration-layer vulnerabilities, which existing tools simply cannot detect!
We all know that DeFi projects undergo code audits, using tools like Slither and Mythril to scan for issues like reentrancy attacks and integer overflows. But Kelp DAO's problem wasn't in the code; it was in the DVN configuration parameter filled out during project deployment!
This parameter isn't in the .sol code file, so Slither and Mythril can't scan it, and existing LLM-assisted audits can't address it. According to related research, current code audit tools can detect at most 8%-20% of exploitable vulnerabilities, and that's assuming "the vulnerability is in the code."
Configuration vulnerabilities have become the "invisible killers" of DeFi security! In 2022, the Nomad bridge lost $190 million due to an initialization error during deployment. This time, Kelp DAO actively chose the risky "1-of-1" configuration and suffered the same fate. Combined, these two types of configuration vulnerabilities have caused approximately $482 million in losses, rivaling the scale of losses from private key leak vulnerabilities!
Yet, the entire industry remains focused on code logic vulnerabilities, training audit tools and optimizing detection models, with no one specifically addressing configuration issues. Like this case, the "1-of-1" configuration fully complied with LayerZero's rules—it wasn't a violation. Yet, this "compliant choice" directly led to a fatal risk.
DeFi security is never just about "code without vulnerabilities." Those subtle details hidden in configurations and operations are the real hidden reefs to watch out for. Hopefully, this lesson will wake up the entire industry and prevent another $293 million tragedy!
Thank you for being so awesome and following me.
