In a movie, Nicolas Cage stole exotic cars in 60 seconds. DeFi hackers just stole $292MM in 46 minutes. The math is not in Nic's favor.
Over the weekend, the Kelp DAO protocol was hacked for $292MM (CoinDesk, April 2026). Kelp specializes in liquid restaking tokens: in exchange for deposited ETH, users receive rsETH, a tradeable claim on the underlying restaked position. The minting process is automated. Hackers found a way to trick the mechanism into believing it had received ETH that didn't exist, creating 116,500 rsETH against phantom collateral. They swapped those tokens across multiple protocols and disappeared before most of the East Coast had finished morning coffee.
Multiple other protocols were left holding collateralized tokens that weren't collateralized. Follow-up attempts for an additional $100MM were blocked only because Kelp froze its chain in time.
Q1 2026 data already showed DeFi protocols had lost $169MM across 34 separate incidents (CryptoBreaking, 2026). Kelp added $292MM in a single weekend. The trajectory is not improving.
In Kelp's case, the single signing authority for approving minting instructions was hijacked. A fatal single point of failure. For the protocols blindly accepting unbacked tokens, the question is where their controls were.
Whether Kelp was hit by an AI-enabled attacker or a human who found a clean loophole, I don't yet know. But the pattern of the attack, systematic vulnerability identification, rapid exploitation, clean extraction, is consistent with AI-assisted tooling. Either way, it's past time to move from "innovation at all costs" to institutional-grade stress testing of DeFi infrastructure.
Is this the wake-up call, or the inevitable growing pains of an interconnected, unmanaged market? I know what I think.
What Liquid Restaking Actually Is, and Why the Complexity Matters
Let me back up for a moment, because the attack only makes sense if you understand what Kelp DAO was doing.
Ethereum's proof-of-stake system lets validators stake ETH to secure the network and earn yield. Restaking goes one step further: it lets those validators simultaneously secure additional protocols, EigenLayer being the primary venue, and earn yield from each. Layered yield on top of staked yield. The appeal is obvious.
Liquid restaking tokens (LRTs) like rsETH wrap this in a tradeable form. You deposit ETH, you receive rsETH, which represents your claim on the underlying restaked position. You can then use rsETH in lending protocols, liquidity pools, or other DeFi applications, earning additional yield while your original ETH is still generating restaking returns.
It's compounded yield with compounded complexity.
The value of rsETH depends on two things: the health of Kelp's underlying restaking positions, and the integrity of the smart contract that mints it. The first risk is well understood. The second is where things fell apart.
The Minting Attack: Why Automated Is Not the Same as Safe
Here's the core of what went wrong.
Kelp's rsETH minting process was automated. When the contract received a signal that ETH had been deposited, it minted the corresponding rsETH. The attack exploited the gap between "the contract received a signal" and "the contract verified the deposit actually happened."
This is a classic oracle manipulation pattern. Smart contracts don't have eyes. They read state from external sources, oracles, and act on what those oracles report. If you can control what the contract believes about the state of the world, you can get it to do things that shouldn't be possible. Kelp's minting mechanism trusted a signal it shouldn't have trusted unconditionally.
We've seen this exact pattern before. Harvest Finance in 2020 (CoinDesk, October 2020). Cream Finance in 2021. Each time, an attacker manipulated what a smart contract believed about prices or balances, and extracted value against phantom collateral. The specific mechanism varies, flash loan price manipulation, reentrancy exploits, oracle price feed attacks, but the underlying vulnerability is the same: the contract acted on reported state rather than independently verified state.
116,500 rsETH minted against nothing. Then swapped. Then gone.
The Single Signing Authority Problem
In Kelp's case, the exploit was enabled by a single signing authority: one key that could approve the minting instructions.
From a risk management perspective, this is about as basic a failure as it gets. In institutional finance, dual-control authorization on material transactions is not a best practice. It's a baseline. Any wire transfer above a threshold, any authorization to move significant funds, requires at minimum two independent approvals: two people, two systems, two keys.
The reason is almost embarrassingly simple: any single point of authority is a single point of compromise. If one key can authorize anything, then stealing one key gives an attacker unlimited authorization.
I spent years on the risk side of large institutions where internal transfers above even relatively modest thresholds required dual controls, documented approval chains, and time-delayed execution for anything above a certain size. Not because the people involved were untrustworthy (they weren't), but because the control architecture assumed that any individual could be compromised, coerced, or simply wrong. The control existed to catch the failure mode.
The equivalent for Kelp's minting process would have been straightforward: require two independent signing keys to approve any minting event above a certain volume. Add a time-lock. Alert on anomalous velocity. 116,500 tokens minted in 46 minutes should have triggered every circuit breaker in the system.
None of those controls existed.
The Downstream Protocol Problem
The damage didn't stay inside Kelp. That's the second failure in this story, and it's arguably the one with broader systemic implications.
Multiple protocols accepted rsETH as collateral without independently verifying that the rsETH in circulation was actually backed. They treated rsETH as if it were equivalent to ETH, which, under normal operating conditions, it effectively was. Under attack conditions, it wasn't.
This is the 2008 CDO problem in miniature. Mortgage-backed securities were treated as safe assets because the underlying mortgages had historically been safe assets. When the underlying started failing, the instruments built on top of them failed too, and the institutions that had accepted them as collateral suddenly held assets worth a fraction of what they'd assumed.
DeFi version: protocols that accepted rsETH as collateral are now holding assets that weren't backed. They took on counterparty risk without stress-testing the underlying collateral source.
The question of protocols verifying the real-time backing status of tokens they accept as collateral is technically solvable. It's just not standard practice. And until it is, every protocol that accepts another protocol's token as collateral is carrying exposure it may not fully understand.
The AI Attacker Problem
Here's the part that concerns me most going forward.
I mentioned sensing the specter of AI in this attack. I want to be clear: I don't know if Kelp was hit by an AI-enabled attacker. What I do know is that the pattern of the attack, systematic identification of a specific vulnerability, rapid exploitation, clean extraction, is consistent with what AI-assisted attack tooling looks like.
Security firms are already documenting what they call "campaign-style" attacks on DeFi: thousands of smart contracts probed for known vulnerability patterns within hours, exploit attempts automated and sequenced, laundering routes pre-computed. The volume is inconsistent with human execution. A skilled human team can analyze a handful of contracts in detail per day. An AI-assisted tool can scan thousands.
This changes the defender's calculus fundamentally. If your security model assumes a human attacker working within human cognitive and temporal constraints, you've already lost ground. The attack surface is being explored faster than human red teams can cover it.
Defenders can use the same tools. AI-assisted auditing, automated vulnerability scanning, real-time anomaly detection: these exist. The gap is that many DeFi protocols aren't using them systematically, while attackers have strong financial incentives to do exactly that.
$292MM in 46 minutes is a fairly compelling return on investment for attack tooling development.
What Institutional-Grade Controls Actually Look Like
The equivalent TradFi control architecture, translated to DeFi, starts with dual signing on material minting events. Any instruction above a defined threshold requires two independent key authorizations, not sequential approvals from the same team.
Add velocity-based time-locks. Minting 116,500 tokens in 46 minutes should be structurally impossible. A circuit breaker that automatically pauses minting above a volume threshold would have stopped this attack cold. The anomaly wasn't subtle: minting velocity 100x above historical average is not a subtle signal.
On the accepting-protocol side: independent collateral verification. Protocols taking rsETH as collateral should run their own verification of rsETH's backing status, not trust the issuing protocol's attestation. Targeted audits of minting logic specifically, not general code reviews, because that's where the value is.
None of these are exotic. They're basic risk management principles applied to a DeFi context. The technology exists to implement all of them. The question is whether the innovation-first culture is willing to accept the friction they introduce.
Friction exists for a reason. This is the reason.
Where This Leaves Us
I've been in this space long enough to have genuine optimism about where DeFi is going. The technology is real. The use cases are real. DeFi United's voluntary rescue pool is genuinely extraordinary, and I've written about that separately.
But rescue pools are a response to damage that shouldn't have happened. The better outcome is controls that prevent the damage in the first place.
Preventable $292MM exploits are the single biggest obstacle to institutional adoption. Every time one happens, it confirms every skeptic's prior about DeFi's maturity. And some of those skeptics have capital allocation decisions to make. The cross-chain concentration risk exposed in the weeks after this exploit tells a parallel story about how infrastructure failures compound when the plumbing is shared.
The TVL is too large, the interconnections too deep, and the attack tooling too sophisticated for the "innovation at all costs" assumptions to hold. The environment changed. The controls need to catch up. For a grounding in how DeFi protocols and liquid restaking actually work, the DeFi Primer covers the mechanics without the jargon.