Tron founder Justin Sun publicly called on the KelpDAO bridge hacker to negotiate a return of the stolen funds, warning that a $292 million loss could bring down both Aave and KelpDAO.
Sun’s appeal followed the largest Decentralized Finance (DeFi) exploit of 2026, which drained 116,500 rsETH from KelpDAO’s cross-chain bridge on April 18.
Sun Moves Funds as Aave Takes the Hit
The attacker exploited a flaw in KelpDAO’s LayerZero-powered bridge, forging cross-chain messages to release rsETH without corresponding token burns.
The stolen tokens were then deposited as collateral on Aave V3, where the hacker borrowed large volumes of Wrapped Ether (WETH) against them.
Because the rsETH became unbacked, the positions are effectively unliquidatable, leaving Aave with over $236 million in bad debt.
Aave froze rsETH markets on both V3 and V4 within hours. Aave founder Stani Kulechov confirmed the exploit originated outside Aave’s contracts.
On-chain data shows Sun urgently withdrew 65,584 ETH, worth roughly $154 million, from Aave and deposited it into Spark shortly after.
His total Aave exposure has reportedly dropped to $380 million, while his Sky and Spark holdings have risen to $2.13 billion.
“OK — Kelpdao hacker, how much you want? Let’s just talk. With KelpDAO’s help, of course. It’s simply not worth it to sacrifice both Aave and KelpDAO and let them go down over this hack,” wrote Justin Sun in a post.
Interoperability protocol Axelar also responded, expressing solidarity with LayerZero and urging the industry to adopt stronger bridge security standards.
Axelar pointed to the importance of multi-validator configurations, noting that Kelp’s single-validator setup may have enabled the breach.
The exploit overtakes the $285 million Drift Protocol hack from April 1 as the largest DeFi loss this year.
