TLDR
A major exploit of Kelp DAOs rsETH restaking bridge drained about $292 million and has become 2026s largest DeFi hack.
- An attacker abused Kelp DAOs LayerZero based rsETH bridge to mint or release 116,500 rsETH, roughly $292 million and about 18% of supply.
- The stolen rsETH was used as collateral across Aave and other lenders, creating large bad debt risks and forcing many protocols to freeze rsETH related markets.
- The incident exposes systemic risks in restaking and cross chain bridges, so users should watch rsETHs peg, redemption mechanics, and recovery plans from Kelp and affected DeFi platforms.
Deep Dive
1. Exploit Scale And Mechanics
Reports agree that Kelp DAOs LayerZero powered bridge for its liquid restaking token rsETH was drained for around 116,500 rsETH, worth roughly $292 million and about 18% of circulating supply. This now ranks as 2026s largest DeFi exploit by value, slightly surpassing the earlier Drift Protocol hack on Solana.
According to on chain analyses, the attacker tricked LayerZeros cross chain messaging layer into treating a fraudulent instruction as valid, causing Kelps bridge to release rsETH to an attacker controlled wallet without proper backing. Kelps emergency multisig paused core contracts about 46 minutes later, blocking further drain attempts but leaving the main loss realized, as detailed in this Kelp DAO exploit summary.
A single validation failure in a bridge contract allowed unbacked rsETH to be created at scale, immediately undermining trust in the tokens backing.
2. DeFi Contagion And Bad Debt
The attacker deposited the illicit rsETH into major lending protocols such as Aave V3, Compound V3, and Euler, then borrowed large amounts of ETH and WETH against it, creating more than $230 million in debt positions across markets. When rsETH proved unbacked, these loans turned into potential bad debt for the protocols holding rsETH collateral.
In response, Aave froze rsETH markets on its V3 and V4 deployments and is assessing how much bad debt remains, while SparkLend, Fluid, and other platforms halted rsETH related activity to contain contagion, as outlined in this cross protocol impact overview. Lido paused deposits into an rsETH exposed product, though its core stETH and wstETH remain unaffected.
Even if your protocol was not directly hacked, composability means toxic collateral can spread losses into many DeFi money markets.
3. Restaking Risks And What To Watch
Kelp DAOs bridge held reserves backing rsETH on more than 20 networks, so holders of rsETH or its wrapped versions on layer 2s now face uncertainty about whether their tokens remain fully backed. Security firms warn that this is a textbook example of how highly integrated restaking assets can turn a single exploit into a system wide event across lending, yield and bridge protocols, as highlighted in this DeFi contagion analysis.
Key things to monitor are: rsETHs market price versus its intended value, Kelps redemption and unwind plans, and formal post mortems or audits from LayerZero and Kelp explaining exactly how validation failed and how similar bridges will be hardened.
If you use restaked or bridged collateral, you should treat bridge and messaging layer security as core risk, not just the main protocols code or the underlying ETH.
Conclusion
The Kelp DAO rsETH bridge exploit shows how a single cross chain validation bug can drain hundreds of millions from DeFi and spread risk into otherwise healthy lending protocols. Until there is a clear recovery path and robust fixes to restaking bridge designs, rsETH and similar heavily composable assets are likely to carry elevated smart contract and collateral risk that users and protocols need to price in carefully.
CoinsKid.Com