What happened in the Kelp DAO exploit?

A $292 million exploit drained 116,500 rsETH through a vulnerability in a LayerZero bridge. The attacker used forged messages to bypass security checks. This made it the largest DeFi exploit of 2026 so far.

What is a DVN and why is it important?

A DVN (Decentralised Verifier Network) helps validate cross-chain transactions. If compromised, it can allow attackers to manipulate asset transfers. This was a key weakness exploited in the KelpDAO attack.

How close was the exploit to becoming worse?

Security firm Cyvers said the protocol was just three minutes away from losing another $100 million. A rapid blacklist intervention stopped the second attempt. This highlights how fast these attacks unfold.

What are “rate limits” in DeFi security?

Rate limits restrict how much value can move through a protocol within a set time. For example, Ethena proposed a $10 million per hour cap on cross-chain transfers. This reduces the scale of potential losses.

Why are industry leaders pushing for rate limits now?

The KelpDAO exploit showed how quickly large amounts can be drained. Rate limits act as a damage control mechanism during attacks. They slow down attackers and give teams time to respond.

What are “smart caps” in lending protocols?

Smart caps limit how quickly collateral supply can grow in lending pools. This prevents attackers from flooding a system with manipulated assets. It adds another layer of risk control.

Would these measures have prevented the KelpDAO exploit?

Experts say rate limits and caps could have significantly reduced losses. They may not stop attacks entirely but can limit damage. This is a mitigation strategy, not a complete solution.

DeFi firms push rate limits after KelpDAO hack

Q: Why did BitGo and Polygon respond quickly?

Both moved to contain potential contagion across interconnected protocols. BitGo suspended LayerZero DVNs for Wrapped Bitcoin as a precaution. Polygon confirmed its ecosystem remained secure and unaffected.

Written by Liezl GambePublished Apr. 20 2026Last Updated Apr. 20 2026

A $292 million exploit linked to Kelp DAO has triggered a wave of security responses across major crypto platforms, including BitGo and Polygon.

The attack exploited a LayerZero bridge vulnerability, draining 116,500 rsETH and prompting firms to isolate potential contagion risks across interconnected protocols.

BitGo suspended LayerZero DVNs for Wrapped Bitcoin as a precaution, while Polygon confirmed its ecosystem remained unaffected and continued normal operations.

Cyvers revealed the protocol narrowly avoided an additional $100 million loss, with a rapid-response blacklist stopping a second exploit attempt within minutes.

Industry leaders are now calling for structural safeguards, including transaction rate limits and supply caps to reduce potential damage from future exploits.

“We built a solution… to throttle cross chain transfers at $10m per hour,”

Said Ethena contributor, Guy Young, highlighting how such limits could have mitigated losses.

The incident has intensified debate around DeFi security design, with experts warning that adopting rate-limiting measures may be critical to preventing larger exploits ahead.

At the time of reporting, Wrapped Bitcoin price was $74,350.15.