A $292 million exploit at KelpDAO set off a broad retreat throughout decentralized finance over the weekend, draining roughly $10 billion throughout the DeFi trade and forcing a number of protocols to freeze markets tied to rsETH.
The breach started late Saturday when an attacker drained about 116,500 rsETH from KelpDAO’s cross-chain bridge. The stolen tokens have been price about $292 million on the time, in accordance with CryptoSlate knowledge.
KelpDAO points rsETH to customers who deposit ETH into its liquid restaking system. The platform then deploys these ETH via the restaking platform EigenLayer to generate further yield on prime of ordinary staking returns.
KelpDAO’s loss now stands as the most important DeFi exploit of 2026 within the report, surpassing earlier assaults this yr.
How KelpDAO was exploited for $292 million
rsETH circulates throughout the broader market by way of LayerZero, a cross-chain messaging community that strikes directions and property between blockchains.
Yearn Finance core developer Banteg defined that the exploit hit the route linking Unichain to the Ethereum mainnet.
In line with the on-chain analyst, the attacker pushed via a fraudulent message that the system accepted as legitimate, prompting the Ethereum-side adapter to launch pre-funded rsETH reserves.
This route was configured as a one-of-one decentralized verifier community path with out secondary verifiers that might have flagged the transaction.
Banteng said that the malicious transaction, recognized as nonce 308, was verified and delivered at 17:35 UTC.
Following the assault, the KelpDAO’s emergency multisignature pockets froze the protocol’s core contracts. This blocked two additional makes an attempt that collectively may have eliminated one other roughly $100 million in rsETH.
The preliminary stolen funds have been moved via Twister Money, obscuring the path earlier than the protocol’s response may include the injury.
In the meantime, the drained reserve-backed wrapped rsETH circulated throughout secondary networks, together with Base, Arbitrum, Linea, Blast, Mantle, and Scroll. As soon as these reserves have been depleted, customers holding rsETH off Ethereum confronted rising uncertainty round redemption and backing.
And that strain shortly fed into the remainder of the market.
Aave takes the heaviest blow
Essentially the most extreme aftershock hit Aave, the most important crypto lending platform, the place the attacker allegedly deposited the stolen rsETH as collateral.
In the course of the assault window, Aave’s pricing oracles continued to learn rsETH close to its regular peg, permitting the protocol to difficulty 106,467 ETH towards the compromised collateral.
That left the platform going through a possible $236 million bad-debt publicity and triggered a rush for the exits.
Knowledge from DeFiLlama confirmed Aave’s whole worth locked dropped from greater than $26 billion to about $20 billion as customers withdrew funds.
The drawdown amounted to one of many sharpest pullbacks on the platform in latest reminiscence and turned a bridge exploit right into a liquidity occasion for the most important lending venue in DeFi.
On-chain analysts revealed that enormous ETH holders on the DeFi platform accelerated the transfer.
For context, TRON founder Justin Solar reportedly withdrew greater than 65,580 ETH, price about $154 million, in a single transaction.
As these sorts of withdrawals mounted, Aave’s ETH utilization price reached 100%, leaving all out there Ether on the platform both borrowed or withdrawn.
In the meantime, the strain additionally spilled into Aave’s market value. The AAVE governance token fell greater than 18% as merchants priced in the potential of deeper losses.
This was exacerbated by heavy gross sales from giant AAVE wallets. Blockchain analytics platform Lookonchain reported that one entity recognized as smaugvision offered greater than 20,000 AAVE for $2.06 million, whereas one other investor offered the same quantity for $2.05 million. A 3rd whale offered almost 19,700 AAVE in trade for wrapped Bitcoin and ETH.
In response to those points, Aave froze the rsETH markets on each V3 and V4. The platform’s founder Stani Kulechov said on X:
“rsETH has been frozen on Aave V3 and V4, the asset doesn’t have any borrowing energy as a measure resulting from KelpDAO bridge exploit that occurred exterior of Aave. Each Aave V3 and V4 doesn’t have additional publicity to rsETH.”
Contagion spreads throughout DeFi
Aside from Aave, different DeFi protocols additionally skilled important withdrawals from their platform because of the assault.
0xngmi, the pseudonymous founding father of DeFiLlama, reported that the incident triggered a $10 billion drop throughout the DeFi sector. This consists of the $6 billion exodus from Aave.
Notably, knowledge from DeFiLlama present that TVL for DeFi protocols has dropped 10% from round $99 billion on April 18 to $89 billion as of press time.
In the meantime, the incident has additionally led a number of DeFi platforms to maneuver shortly to scale back their publicity to the embattled rsETH token.
DeFi analyst Ignas flagged eight further DeFi protocols, together with Lido, SparkLend, Fluid, Compound, and Euler, which froze their rsETH lending markets.
He added:
“I suppose LayerZero might be affected too, as rsETH have been bridged from L2s, so I ponder if these rsETH on L2s aren’t nugatory proper now.”
In the meantime, Ethena, the developer of the artificial USDe greenback, quickly suspended its LayerZero bridges as a precaution, whereas stating that it had no publicity to rsETH.
These strikes mirrored how extensively rsETH had been embedded throughout DeFi because it was deeply utilized in lending markets, vault merchandise, and collateral methods that trusted clean cross-chain transfers and confidence in reserve backing.
As that confidence weakened, protocols moved to ring-fence danger earlier than additional withdrawals or value dislocations may deepen the injury.
The pressure additionally uncovered the velocity at which capital can transfer as soon as collateral high quality comes into query. A bridge exploit at one venue was sufficient to ship shockwaves via a number of markets inside hours, pushing platforms to droop exercise even when their very own contracts had not been instantly breached.
Crypto group requires answer to DeFi bridge hacks
Jonathan Man, the Head of Multi-Technique Options & DeFi Methods at Bitwise, mentioned:
“That is one other setback however we are able to bounce again stronger. We as an trade must collectively up our recreation to ensure we’re constructing the way forward for finance on strong foundations.”
In the meantime, the KelpDAO exploit additionally prompted broader dialogue about how lending protocols and token issuers can restrict the injury from hacks focusing on bridged or thinly traded property.
Keone Hon, co-founder of Monad, mentioned pooled lending protocols ought to take into account imposing price limits on how shortly an asset will be deposited and used as collateral.
Beneath that mannequin, an asset with a present circulating provide of $100 million and a proper cap of $300 million wouldn’t be allowed to leap straight to the total cap in a single burst. As a substitute, the provision allowed into the system would rise regularly over a set interval, equivalent to 10 minutes or a couple of hours.
Hon mentioned that strategy would chop the out there exit paths when an unique asset is exploited, particularly in circumstances involving infinite-mint bugs.
He argued that the dimensions of the loss is usually decided much less by the mint itself than by how a lot of the compromised asset will be offloaded into lending venues or different liquid exits earlier than markets react.
In that framework, giant lending protocols develop into the principle launch valves as a result of decentralized trade liquidity is usually too restricted to soak up a serious exploit.
He added that asset issuers must also have an curiosity in tighter caps, significantly once they difficulty receipt tokens with delayed redemption. In these circumstances, the issuer shouldn’t be essentially uncovered to fast redemption strain from an attacker, however nonetheless advantages when downstream exit routes stay constrained.
Hon pointed to the Hyperbridge DOT exploit and the Resolv incident as examples the place losses stayed under extra catastrophic ranges as a result of the out there paths for exiting the hacked asset have been restricted.
Man Younger, founding father of Ethena, endorsed that view and mentioned issuers ought to take into account including price limits on the mint and redemption layer, in addition to customized throttles on prime of LayerZero’s OFT customary.
