Sun Yuchen just withdrew 126 million USD five hours ago, and Kelp was hacked for 280 million USD— coincidence or script?
He just withdrew money, and the hacker struck: the biggest “coincidence” in DeFi has finally arrived.
A 280 million USD attack, five hours before the attack happened, Sun Yuchen just withdrew 126 million USD worth of ETH from Aave.
Not the day before, not a week ago.
Five hours.
---
Here's what happened:
On April 18th, KelpDAO’s rsETH was hacked.
The hacker exploited a vulnerability in LayerZero, minting 116.5k rsETH out of thin air, worth 292 million USD.
Then they deposited it into Aave, Compound, Euler as collateral, borrowed ETH, and cashed out.
They stole a total of 74k ETH, equivalent to 280 million USD.
The biggest DeFi attack of 2026, just like that.
---
Five hours before the attack—
Sun Yuchen’s address withdrew 53,665 ETH from Aave.
116.5k USD.
The funds are still in his wallet, untouched.
Here’s the question:
How did he know something was going to happen in five hours?
---
I don’t care if you believe it or not, on-chain data doesn’t lie.
I’m not saying Sun Yuchen is the hacker.
What I’m saying is:
- A whale, long active in DeFi
- Five hours before one of the largest attacks in history, precisely withdrew 126 million USD
- After withdrawing the money, the attack happened
- His funds remained untouched, completely clean
If you think this is just a coincidence, then I can only say:
The place with the most coincidences in this world is the on-chain records of the crypto space.
---
Not every withdrawal is a run, but when Sun Yuchen withdraws money, you’d better check your own positions too.
Hackers need vulnerabilities; whales just need timing.
Aave’s bad debt hit 236 million USD, AAVE dropped 10%, and retail investors lost money exactly equal to what Sun Yuchen withdrew five hours earlier.
---
What’s even more outrageous is still to come.
46 minutes after the attack, Kelp paused the contract.
But then there were two more attempted attacks, each involving 40k rsETH, which were stopped.
That means the hacker didn’t want to do another round—they just couldn’t succeed.
And rsETH is now held across more than 20 chains, like a ticking time bomb.
Aave directly froze the rsETH market, SparkLend, Fluid, Upshift all followed suit.
The entire DeFi ecosystem, because of this fuse, has been halved.
---
The attacker started money laundering via Tornado Cash’s 1-ETH pool ten hours ago.
That means, before Sun Yuchen withdrew his funds, the hacker was already prepared with mixers.
Does this operation look like a pre-written script?
We’re not short of vulnerability audits or security patches.
What we lack is an answer:
When a whale like Sun Yuchen withdraws precisely five hours before a large-scale attack—
Should we monitor him, or just assume this is “normal transaction behavior”?
---
Not every withdrawal is a run, but when Sun Yuchen withdraws money, you’d better check your own positions too.
Aave’s bad debt hit 236 million USD, AAVE dropped 10%, and retail investors lost money exactly equal to what Sun Yuchen withdrew five hours earlier.
Do you think this is just a coincidence, or does someone already know something?
Share this so your friends also know—next time Sun Yuchen withdraws, don’t just stand there clueless. #山寨币强势反弹 #GatePreIPOs首发SpaceX $ETH