Kelp DAO Cross-Chain Bridge Exploited, $292 Million in rsETH Stolen in 2026's Biggest DeFi Hack

Trump: Vance won't join renewed U.S.-Iran talks U.S. media reported that President Trump said in an April 19 interview that Vice President Vance will not attend the renewed U.S.-Iran negotiations due to security concerns. Trump added that U.S. special envoys Witkoff and Kushner will arrive in Islamabad, Pakistan, on the evening of April 20 (ET) for talks scheduled on April 21. Poll: Trump approval hits new second-term low; most disapprove of economic policy and Iran war handling An NBC News poll shows Trump's overall approval rating has fallen to a new low in his second term, with 37% approving and 63% disapproving, including 50% who strongly disapprove. Roughly two-thirds said they are dissatisfied with his handling of inflation, cost of living, and the war with Iran. The survey found 40% of Americans feel worse off financially than a year ago, and 61% oppose further U.S. military action against Iran. The poll was conducted by SurveyMonkey from March 30 to April 13 among 32,433 adults. China's draft Financial Law public comment period ends; little on digital currency status or crypto regulatory boundaries Caixin reported that the one-month public consultation for the draft Financial Law of the People's Republic of China ended on April 19. The draft has drawn market attention for expanding "quasi-judicial powers" for financial regulators. Under Article 55 and related provisions, regulators would be allowed, during investigations of financial violations, to access and copy financial, communications, and transaction records; directly freeze or seal assets and securities suspected of being transferred or concealed; and restrict individuals under investigation from leaving the country during the probe. Zeng Gang, Chief Expert and Director at the Shanghai Laboratory for Financial Development, said the law should also better cover emerging areas of finance. Topics such as AI-driven financial decision-making, the legal status of digital currencies, and the regulatory boundaries of crypto assets are largely absent from the draft, leaving lawmakers facing the ongoing challenge of balancing oversight with innovation. Kelp DAO cross-chain bridge compromised; about $292 million in rsETH drained CoinDesk reported that Kelp DAO's cross-chain bridge built on LayerZero was exploited, with the attacker transferring 116,500 rsETH worth about $292 million at current prices, around 18% of circulating supply. The incident is the largest DeFi attack reported so far in 2026. Aave, SparkLend, and Fluid froze rsETH-related markets, and Lido Finance paused new deposits into its earnETH product. Kelp DAO said it is investigating alongside LayerZero, audit firms, and external security specialists. Aave sees $6.6 billion in daily withdrawals; stablecoin borrow rates jump Aave recorded $6.6 billion in daily withdrawals, while USDT and USDC borrowing rates climbed to 15%. Aave core contributor Marc Zeller wrote on X that a proposal has been launched to end the AaveChan Initiative (ACI) Frontier project. He said he has run Ethereum staking nodes for the Aave DAO for several years, but will exit all validators and return all ETH to the DAO to help protect wETH depositors. He also plans to waive any income tied to the service to reduce user impact. Zeller has been among the most active contributors in the Aave ecosystem and previously announced he would leave Aave in July. Curve halts LayerZero bridge features after rsETH infrastructure breach Curve Finance said it has suspended its LayerZero bridge functions due to the hacker attack targeting rsETH's LayerZero infrastructure, pending a root-cause review. The pause affects CRV cross-chain bridging from BNB Chain, Sonic, Avalanche, Fantom, Etherlink, and Kava (chains using native bridges are not affected), and also suspends the crvUSD fast bridge (the L2 slow bridge remains available). Separately, reports also said KelpDAO was hit via a vulnerability exploit with an estimated loss of about $291 million, with the final figure still under review. Sky pauses USDS OFT bridge; protocol and contracts not impacted Sky (formerly MakerDAO) said on X it has temporarily paused the Omnichain Fungible Token (OFT) bridge for USDS while assessing any knock-on effects from the rsETH incident. Sky said its protocol and the USDS contract were not affected, and that USDS remains fully collateralized as designed, verifiable on-chain at any time. Vercel reports unauthorized access to internal systems Cloud hosting platform Vercel disclosed a security incident involving unauthorized access to certain internal systems, affecting a small number of customers. Vercel said services remain operational, an investigation is underway with incident-response experts engaged, and law enforcement has been notified. The company advised customers to review environment variables and enable sensitive environment variable protections. Fu Peng joins Hong Kong-listed Xinhuo Group as chief economist Tencent News outlet "Yixian" reported that Fu Peng, former Chief Economist of Northeast Securities, has joined Hong Kong-listed Xinhuo Group (1611.HK) as Chief Economist, a move confirmed by the company. Fu said his focus will be integrating FICC (Fixed Income, Currencies, and Commodities) with crypto-related businesses, leading macro research and providing institutional investment strategy analysis. Xinhuo Group, formerly Huobi Technology, has repositioned as a private-banking-grade digital asset custody provider. Huobi founder Li Lin is the sole major shareholder with a 29.82% stake. Fu served as Northeast Securities' Chief Economist from 2020 and resigned on April 30, 2025. Mong Kok hotel rape case: charges withdrawn; two men released after more than five months Sing Tao Daily reported that two mainland men on dual-entry permits—Wang Baichuan (27, business consultant) and Xu Zilan (24, sales clerk)—were charged with raping a woman on Nov. 4, 2025 at the Rui Jing Hotel in Mong Kok (23 Tai Nan Street). Both faced one rape count and had been detained since mid-November 2025. At a hearing on April 18 at West Kowloon Magistrates' Courts, prosecutors sought and received permission to withdraw the charges. One defendant applied for legal costs; prosecutors opposed, saying both men admitted having sex with the complainant and only provided phone passwords for investigation a month after being charged. Prosecutors said they sought further legal advice before withdrawing. The judge found the defendants had not provoked suspicion and granted legal costs. This week's major token unlocks: ZRO, XPL, KAITO and more Token unlock data show large releases scheduled this week: - LayerZero (ZRO): 25.71 million tokens on April 20, about $40.4 million, 5.34% of circulating supply - Humanity (H): 105 million on April 25, about $10.8 million, 4.02% - Plasma (XPL): 88.89 million on April 25, about $9.4 million, 3.83% - Hyperlane (HYPER): 89.75 million on April 22, about $8.6 million, 94.37% - Limitless (LMTS): 85.37 million on April 22, about $8.5 million, 64.99% - KAITO (KAITO): 17.6 million on April 20, about $8.1 million, 4.93% - Initia (INIT): 82.94 million on April 24, about $7.8 million, 45.18% - SoSoValue (SOSO): 13.3 million on April 24, about $5.5 million, 4.35% - Monad (MON): 170 million on April 24, about $5.5 million, 0.34% - aPriori (APR): 31.88 million on April 23, about $5.3 million, 12.72% Market reads - SpaceX reportedly bought nearly one-fifth of U.S. Cybertrucks, enabling more than $100 million in sales via internal transfers. The piece examines collapsing Cybertruck demand, related-party transactions among Elon Musk's companies, governance transparency concerns, Tesla's three straight years of annual sales declines, BYD overtaking Tesla as the top global EV seller, and Tesla shares down about 20% since December 2022. - Netflix founder Reed Hastings said he will not seek re-election after his term ends in June, following record Q1 2026 results. He highlighted concerns about rapid AI progress and its potential disruption to content creation, and noted his new board role at Anthropic focused on AI safety and long-term social benefit. - Cloudflare rolled out multiple updates in one week at "Agents Week 2026," including a unified inference layer connecting 70+ models and an email service that lets AI agents send and receive emails, positioning the company as infrastructure for the AI agent era. - Podcast notes: Hyperliquid is drawing interest from traditional hedge funds, with discussion spanning on-chain perpetuals growth, DeFi and stablecoins, tokenized equities, prediction markets, and evolving regulation. - Feature: The 2026's biggest DeFi heist details how attackers stole $292 million in rsETH by forging cross-chain requests, then liquidated positions via Aave V3. The incident highlights security weaknesses in cross-chain bridges and risks amplified by DeFi composability.