Kelp DAO issued a statement on April 21 rebutting LayerZero’s criticism of its 1/1 DVN configuration, pointing the root responsibility for the $292 million vulnerability in this incident to LayerZero’s infrastructure. Aave released an event impact assessment report: under a scenario where losses are evenly distributed, about $124 million; under a scenario where losses are concentrated on L2, they reach up to $230 million.

Bitcoin (BTC) sees a V-shaped rebound. As of April 21, it is temporarily around $76,028. U.S. President Trump says he is willing to hold direct talks with Iran’s top leadership. Lido said that the EarnETH treasury holds an exposure of about $21.6 million in rsETH, and the loss-protection mechanism is ready. DeFi has lost more than $600 million over the past three weeks, and the Kelp DAO incident has dragged DeFi TVL down to a one-year low.

LayerZero issued a statement regarding the $292 million hack suffered by Kelp DAO, accusing Kelp’s self-selected 1-of-1 DVN configuration of making the incident possible. The attacker was the North Korean Lazarus Group. LayerZero emphasized that this incident stems from configuration choices and that it will no longer support this kind of vulnerable setup. In addition, responsibility is still disputed, and no compensation plan has been provided.

In April 2026, within just 20 days, cryptocurrency protocols suffered losses of more than $606 million due to hacker attacks, becoming the worst single-month loss record since the February 2025 exchange incident in which $1.4 billion in data was leaked. The two attacks by KelpDAO and Drift Protocol accounted for 95% of April’s losses, and 75% of the total $771.8 million losses as of now in 2026.

David Schwartz, CTO Emeritus at Ripple, analyzed bridge security vulnerabilities following the $292 million Kelp DAO exploit. He noted that providers prioritized convenience over robust security, undermining essential protective features. The Kelp DAO breach stemmed from a private key leak, exacerbated by a simplified security configuration in their LayerZero implementation.

Curve Finance has been attacked over LayerZero infrastructure related to rsETH, and has temporarily suspended cross-chain functionality to prevent risk, impacting CRV cross-chain bridging and the fast bridging of crvUSD. Founder Egorov said the incident demonstrates the risk of “non-isolated lending,” and proposed a fully isolated mode as an alternative. Kelp DAO also suffered losses of about $292 million due to the attack, affecting lending activity on the Aave platform.

The Reserve agreement was paused on April 20 for the minting of eUSD and USD3 and the RSR redemption and withdrawal operations due to the Kelp DAO rsETH attack event, but the redemption function remains operational. The attack caused a liquidity crisis at Aave, deposits dropped significantly, and the price of AAVE tokens fell.

Kelp DAO was hacked on April 19. The attacker used LayerZero’s cross-chain bridge to forge messages, releasing 116,500 rsETH, for losses of about $292 million, making it the largest DeFi event of 2026. This incident highlights security vulnerabilities in cross-chain bridges, triggering a sharp market reaction; related protocols also urgently froze assets, facing further liquidation risk.

TRON founder Justin Sun publicly announced on the X platform this week that the TRON network will launch a post-quantum cryptography (PQC) upgrade plan, aiming to directly integrate anti-quantum cryptographic signature standards into the TRON mainnet. As of April 17, Tron DAO has not released any formal governance proposals or technical documents; the related announcements are currently limited to Justin Sun’s public statements.