What happened in the KelpDAO exploit involving Justin Sun?

A $292 million exploit drained 116,500 rsETH from a KelpDAO bridge, which was then used on Aave to borrow funds. This created over $236 million in bad debt and destabilised parts of the DeFi ecosystem. Justin Sun publicly responded by offering to negotiate with the attacker.

Why did Justin Sun offer to negotiate with the hacker?

Justin Sun said a deal could prevent further damage to both Aave and KelpDAO. His public message suggested recovering funds may be more practical than pursuing enforcement. This approach has precedent in crypto, but success is not guaranteed.

How did the attacker create bad debt on Aave?

The attacker used stolen rsETH as collateral on Aave to borrow assets like wrapped Ether. Because the rsETH was unbacked, the loans could not be properly liquidated. This left Aave with over $236 million in bad debt.

What actions did Aave take after the exploit?

Aave froze rsETH markets on both V3 and V4 to prevent further damage. The protocol also removed the token’s borrowing power. These measures are designed to contain risk and protect remaining liquidity.

How did Justin Sun react with his own funds?

Justin Sun withdrew 65,584 ETH (around $154 million) from Aave shortly after the exploit. He moved funds into Spark, reducing his exposure to Aave. This suggests a defensive move to manage risk.

What caused the KelpDAO exploit technically?

The exploit stemmed from a flaw in a LayerZero-powered bridge, where attackers forged cross-chain messages. This allowed them to mint or release rsETH without proper backing. It highlights ongoing risks in cross-chain infrastructure.

How did the market and DeFi ecosystem react?

The exploit triggered instability across DeFi, including liquidity stress on Aave. It also raised broader concerns about systemic risk and protocol interdependence. Events like this often lead to short-term volatility.

What is rsETH and why is it important in this incident?

rsETH is a liquid staking token issued by KelpDAO, representing staked Ethereum. It was central to the exploit because it was used as collateral to borrow real assets. Once compromised, it caused cascading effects across protocols.

Justin Sun seeks deal after $292M KelpDAO hack

Written by Mahathir BayenaPublished Apr. 20 2026

Justin Sun has called on the KelpDAO hacker to negotiate the return of funds following a $292 million exploit that destabilised major DeFi protocols.

The attack drained 116,500 rsETH from a LayerZero-based bridge and was used as collateral on Aave to borrow assets, leaving more than $236 million in bad debt.

“OK — Kelpdao hacker, how much you want? Let’s just talk,”

Sun said, adding:

“It’s simply not worth it to sacrifice both Aave and KelpDAO and let them go down over this hack.”

Aave froze rsETH markets across V3 and V4, with founder Stani Kulechov confirming the exploit originated outside the protocol’s contracts.

Following the attack, Sun withdrew 65,584 ETH, worth about $154 million, from Aave and moved funds into Spark, reducing his exposure to the platform.

The breach has been linked to a flaw in a LayerZero-powered bridge used by Kelp DAO, where forged cross-chain messages enabled the release of unbacked tokens.

The incident has intensified scrutiny on cross-chain bridge security, with Axelar Network urging stronger validator systems to prevent similar exploits.

At the time of reporting, Aave price was $90.94.