$300M Crypto Hack Exposes DeFi Bridge Security Flaws

Kelp DAO's $300M Bridge Hack Sparks Crypto Market Turmoil and Security Fears

Hackers Exploit Kelp DAO Bridge, Stealing Up to $300 Million in rsETH Tokens

Between April 18 and 20, 2026, hackers exploited a vulnerability in the LayerZero-based rsETH bridge operated by Kelp DAO, manipulating cross-chain communication to steal rsETH tokens worth between $290 and $300 million. The attack, which relied on a sophisticated exploit, is suspected to have been carried out by Lazarus Group, the notorious hacking collective linked to North Korea's state-sponsored cyber operations.

On April 21, the Arbitrum Security Council intervened, freezing 30,766 Ether—valued at approximately $71 million at the time—connected to the exploit. The funds were transferred to a secure, controlled address to prevent the hackers from accessing them.

Hackers Move to Cash Out Stolen Funds

The attackers have since begun laundering nearly all the stolen Ether. Around 75,700 Ether were converted into Bitcoin via THORChain, a cross-chain liquidity protocol, incurring transaction fees of roughly $910,000—a windfall for the platform.

The hackers first distributed the stolen Ether across newly created wallets before funneling the funds through THORChain and the privacy tool Umbra. Analysts note that this method reflects a deliberate exit strategy, aimed at converting the loot into liquid assets—a tactic consistent with Lazarus Group's modus operandi, as North Korea has long relied on cyber heists to fund its operations.

DeFi Under Fire as Market Confidence Wavers

The Kelp DAO breach sent shockwaves through crypto markets, briefly pushing Bitcoin back under pressure. Over the past weekend, BTC dipped to just below $74,000 before recovering to climb above $78,000, even touching $79,000 at its peak.

While Ethereum's Ether—despite being more directly impacted—suffered relatively minor losses, many Decentralized Finance (DeFi) tokens faced steeper declines, even those with no direct ties to Kelp DAO. For instance, Aave briefly plummeted below $90.

Critics have grown increasingly skeptical of DeFi, arguing that repeated high-profile hacks have severely undermined trust in the sector. Cross-chain bridges, in particular, have proven especially vulnerable, raising urgent calls for more robust security solutions—a sentiment I wholeheartedly endorse.

Don't Count DeFi—or NFTs—Out Just Yet

That said, I don't believe DeFi is doomed—any more than I'd write off NFTs or other once-hyped crypto innovations like the Metaverse. The real issue was the excessive speculation that surrounded these trends, with investors blindly pouring money into assets simply because prices were surging.

I'll never forget when, during the height of the hype, I was pressured in the TAK [investment group] to highlight individual NFTs—a request I flatly refused. Similarly, we steered clear of many dubious Metaverse projects. When markets overheat, too many investors abandon due diligence, buying purely on momentum—a recipe for disaster.

As Warren Buffett famously warned, chasing an asset just because it's rising is one of the dumbest reasons to invest. If further proof were needed, this cycle has provided it in spades. But here's the thing: reports of DeFi's death—or NFTs', or even the Metaverse's—are greatly exaggerated. While I wouldn't bet on a Metaverse revival just yet, never underestimate the resilience of these technologies.

Opportunities for Contrarian Investors—Seize Them with Kraken!

In my view, there are now some real opportunities for contrarian investors—not just in the software (or software-as-a-service) sector, but also in the crypto space, particularly in areas like DeFi and NFTs. Right now, buying Chainlink (LINK), Sky (formerly Maker (MKR)), Aave, or Cosmos (ATOM) could be worth considering. The same goes for Chiliz (CHZ) in the NFT sector.

All of these trades can be easily executed through Kraken or its new trading platform, Kraken Pro. If you sign up, deposit funds, and buy crypto there, you can also get a €30 bonus. Get started now!

For now, though, steer clear of World Liberty Finance (WLFI), a project with ties to the family of former U.S. President Donald J. Trump. Want to know why? Stay tuned—you'll find out in next week's article right here!