DeFi hack drains $290M on Ethereum

TLDR

A major exploit against Kelp DAOs rsETH bridge on Ethereum has drained roughly 290 million dollars and triggered stress across several DeFi lending markets.

1. An attacker abused Kelp DAOs LayerZero based rsETH bridge to steal about 116,500 rsETH, worth around 292 to 294 million dollars, roughly 18 percent of rsETH supply.
2. The attacker used the stolen rsETH as collateral on lending protocols like Aave and others, creating large bad debt and forcing emergency freezes in rsETH markets across Ethereum and Arbitrum.
3. The incident exposes serious risks around cross chain bridges and liquid restaking collateral, so users should reassess exposure to rsETH like tokens and their integrations across DeFi.

Deep Dive

1. How The Exploit Happened

Multiple reports say Kelp DAO, a liquid restaking protocol, was hacked for about 292 million dollars when its LayerZero powered bridge released 116,500 rsETH to an attacker controlled wallet, equal to roughly 18 percent of rsETH supply, making it the biggest DeFi exploit of 2026 so far. One detailed breakdown describes how the attacker manipulated LayerZeros cross chain messaging, tricking the system into accepting a fraudulent transfer instruction and draining the bridge reserve that backed rsETH on more than twenty networks.

Security analyses point to a bug in the so called OApp peer trust or validator setup, effectively a single point of failure in the cross chain verifier that allowed one compromised key or faulty message to unlock the entire rsETH reserve. Estimates of total damage cluster between 280 and 294 million dollars, depending on Ethereums price at the time, but all place the loss near 290 million dollars.

2. DeFi Contagion On Ethereum

Once the attacker controlled the rsETH, they deposited it into lending protocols such as Aave V3, Compound and others to borrow real assets including WETH and ETH, leaving those protocols with unliquidatable positions once rsETH became effectively unbacked. Coverage notes that Aaves WETH pool now carries bad debt tied to these positions, and AAVEs token dropped sharply on the news.

To contain contagion, Aave froze rsETH markets on its V3 and V4 deployments, and other platforms including SparkLend, Fluid and Lidos rsETH exposed earnETH product paused or restricted rsETH activity. Because rsETH had been integrated across many chains, the emptied bridge reserve also raises questions about whether rsETH circulating on layer 2 networks remains fully backed, putting pressure on its peg and on Kelps ability to honor redemptions.

3. Risk Lessons And What To Watch

This exploit highlights three structural risks. First, cross chain bridges that rely on small validator sets or complex messaging layers can become single points of catastrophic failure, even when the underlying chains are secure. Second, liquid restaking tokens like rsETH, which are widely rehypothecated as collateral, can create systemic risk because a flaw in one protocol propagates into many others through composability. Third, users are often exposed indirectly via yield products and vaults that hold these assets on their behalf.

Near term, key things to watch are: Kelp DAOs remediation and any recovery plan, risk and backstop decisions from Aave and other affected protocols, and any further technical disclosure from LayerZero about fixes to the messaging bug. For individual users, a practical check is to review whether you hold rsETH itself or use products and lending markets that list it as collateral and to monitor governance and risk updates from those platforms.

Conclusion

A roughly 290 million dollar exploit of Kelp DAOs rsETH bridge has become the largest DeFi hack of 2026 and has exposed how intertwined liquid restaking and lending protocols are on Ethereum. The direct theft matters, but the lasting impact will come from how quickly bridges are hardened, how lending platforms resolve the new bad debt, and how investors adjust their tolerance for highly composable, cross chain collateral.