Timeline of the exploit during April 2026
17:35 UTC — Start of the attack
The attacker sends a false cross-chain message proof to the Kelp DAO bridge based on LayerZero.
The contract accepts the message as valid.
116,500 rsETH are released unbacked to the attacker's wallet.
Approximate value at that moment: ≈ 292 million USD (18% of the token supply). �
defiprime.com +1
👉 This is where the hack really begins.
17:35 – 18:21 UTC — DeFi exploitation phase
During the following minutes, the attacker executes the second phase: