Luisa Crawford
Apr 19, 2026 17:45
Kelp liquid restaking hack cascaded by way of Aave, Compound, and seven different DeFi platforms. rsETH down 23% as trade debates remoted lending dangers.
A $293 million exploit of liquid restaking protocol Kelp DAO has rippled throughout the DeFi ecosystem, forcing no less than 9 main platforms to freeze markets or scramble injury management measures in what safety researchers are calling a “cross-protocol contagion occasion.”
The assault, which focused Kelp’s rsETH adapter bridge contract on Saturday, did not keep contained. Aave, Compound Finance, Fluid, SparkLend, and Euler all took emergency motion to freeze rsETH markets because the exploit’s shockwaves unfold by way of interconnected lending swimming pools.
rsETH has cratered 23% previously 24 hours, buying and selling at $1,962 with a market cap of $1.23 billion as of Sunday afternoon.
The Cross-Chain Drawback
Curve Finance founder Michael Egorov pointed to non-isolated lending because the core vulnerability that allowed localized injury to change into systemic. Earlier variations of Aave and comparable protocols expose customers to dangers from each token accepted as collateral—when one fails, everybody holding positions in that pool will get damage.
“Cross-chain is tough and doubtlessly dangerous. Solely use cross-chain infrastructure when completely crucial, and do it actually fastidiously,” Egorov mentioned, noting that Kelp’s bridge structure was the assault’s entry level.
His recommendation for DeFi groups: vet tokens for single factors of failure earlier than approving them as collateral. Simpler mentioned than achieved when yield-hungry protocols race to combine the most recent restaking derivatives.
A Sample Rising
This wasn’t an remoted incident. The Kelp exploit follows final week’s $280 million Drift Protocol hack and no less than 12 different crypto platform assaults earlier this month. Q1 2026 losses from hacks, exploits, and scams already hit $482 million earlier than this weekend’s occasions.
Blockchain safety agency Cyvers mapped how the stolen funds moved by way of Twister Money and transformed to ETH throughout a number of networks—a now-familiar laundering playbook.
“The problem is now not simply stopping exploits on the contract stage, however understanding how briskly they’ll cascade throughout built-in protocols,” Cyvers CEO Deddy Lavid instructed Cointelegraph.
What Occurs Subsequent
Kelp has paused all rsETH good contracts whereas investigating. The protocol, based by the staff behind Stader Labs, constructed its enterprise on simplifying restaking by letting customers deposit liquid staking tokens and obtain rsETH—a token that would then be used throughout DeFi for added yield.
That composability, which made Kelp enticing, additionally made it harmful. When rsETH grew to become nugatory collateral in a single day, each protocol that accepted it confronted the identical downside concurrently.
For merchants with publicity to any of the 9 affected platforms, the fast precedence is checking place well being and monitoring bulletins from protocol governance. The broader query—whether or not DeFi’s interconnected structure creates unacceptable systemic danger—will not be answered this week. Nevertheless it’s getting tougher to disregard.
Picture supply: Shutterstock
