KelpDAO: rsETH Records $936k Net Outflows One Month Post-Hack – Details

The $292 million KelpDAO exploit is among the biggest crypto losses of 2026. The impact of this attack on users’ confidence was broad, triggering a $13.5 billion drop in DeFi total value locked (TVL). However, recent developments suggest a return in market confidence.

Investors Move To Accumulate rsETH As KelpDAO Resumes Operations 

On April 18, attackers exploited a vulnerability in KelpDAO’s LayerZero-cross chain bridge, carting away 152,577 rsETH, valued at $292 million. According to a report from analytics firm Santiment, this day also experienced a net inflow of 563 rsETH, worth $1.1 million, into exchanges. Santiment analysts explain that the market reaction is expected, as the exploit has generated concern about KelpDAO’s safety and rESTH. Therefore, investors moved their holdings to exchanges to sell or swap them for other assets, e.g., stablecoins, thereby reducing their exposure to the negative effects of the hack.

Following the hack, there have been multiple recovery efforts, including coordinated seizures by the KelpDAO, Abritrum, and Aave of the hackers’ positions on their respective platforms. In particular, the Aave DAO also issued donations alongside the DeFi platforms such as EtherFi, Lido, and Ethena. On May 15, KelpDAO announced a resumption of reETH activities, including withdrawals, bridging, and protocol operations. Santiment observed that this announcement was shortly followed by a net outflow of approximately 435 rsETH ($936,000) from exchanges.

In line with typical market dynamics, this outflow signals growing investor confidence in rsETH following the recovery process and the lifting of restrictions. There is now a clear shift of rsETH away from exchanges and into self-custody wallets, staking platforms, and DeFi protocols.

THORChain Suffers $11 Million Hack

In other news, the decentralized liquidity protocol THORChain has suffered an attack resulting in losses of $10.8 million, according to an independent on-chain investigator, ZachXBT. The exploits occurred across four blockchains, including Bitcoin, Ethereum, Binance Smart Chain (BSC), and Base. 

As a cross-chain exchange, THORChain enables direct swaps between various blockchains and has previously been used as a laundering rail by bad actors and hackers. Following the recent exploit, WuBlockchain reports that the protocol’s management has halted trading and issued a global emergency alert.

Exploits and hacks remain a major security concern for crypto users. According to DefiLama today, total losses from these malicious activities in 2026 are now $823.9 million. At press time, the total crypto market cap is $2.57 trillion, down 2.74% over the past day.