TLDR
A massive exploit on KelpDAOs rsETH liquid restaking token drained roughly 292 to 294 million dollars and triggered a cascade of risk across multiple DeFi protocols.
- KelpDAOs LayerZero based rsETH bridge was exploited, letting an attacker mint 116,500 unbacked rsETH worth about 293 million dollars and swap or collateralize it for real assets.
- The attacker used rsETH as collateral on lending protocols like Aave, borrowing over 200 million dollars in ETH and stablecoins and leaving significant bad debt that has forced multiple markets to pause.
- The incident exposes systemic risks in liquid restaking and cross chain bridges, so users should watch protocol responses, bad debt resolutions, and any wider rethink of using LRTs as collateral.
Deep Dive
1. How The Restaking Exploit Worked
Reports agree that liquid restaking protocol KelpDAO was hit for about 292 to 294 million dollars after an attacker abused its rsETH bridge, which runs over LayerZeros cross chain messaging layer. Analyses say the attacker tricked the bridge contract into releasing 116,500 rsETH without proper backing, then quickly swapped much of it for ETH and spread funds across Ethereum and Arbitrum, making this the largest DeFi hack of 2026 so far. Coverage details that the exploit targeted KelpDAOs rsETH adapter or bridge contract, not the core Ethereum staking layer, but wiped roughly 18 percent of rsETHs circulating supply in minutes.
The failure point was in cross chain minting and verification logic, not in Ethereum itself, which underlines bridge contracts as one of the riskiest pieces of DeFi infrastructure.
2. Contagion Across Aave And Other Protocols
Because rsETH was widely accepted as high quality collateral, the attacker deposited the illicit rsETH into lending markets such as Aave V3, Compound V3, Euler and others and borrowed more than 236 million dollars in WETH and other assets against it. Once rsETH was revealed as unbacked, these positions became effectively unliquidatable, leaving protocols with large pockets of bad debt and forcing Aave and several others to freeze rsETH markets while they assess the damage. One report notes that rsETH and its wrapped variants exist on more than twenty networks, so the emptied bridge reserve has also created uncertainty for cross chain rsETH holders and stressed liquidity in related products.
Composability amplified the blast radius, turning a single minting flaw into a multi protocol credit event that now has to be worked out through governance, safety modules and possibly socialized losses.
3. Why It Matters For Restaking And What To Watch
Liquid restaking tokens such as rsETH were marketed as a safe yield layer, yet this exploit shows how complex cross chain restaking stacks can hide single points of failure in bridges and adapter contracts. In the near term, this is likely to tighten risk limits around LRT collateral, encourage more aggressive circuit breakers, and increase scrutiny on LayerZero based integrations and other bridge providers. Key things to monitor are: official post mortems from KelpDAO and LayerZero, how Aave and peers choose to resolve bad debt, and whether other restaking projects change parameters or pause integrations in response.
If you use LRTs or cross chain wrapped assets in DeFi, this is a prompt to recheck protocol announcements, collateral listings and pause notices rather than assuming blue chip integrations are automatically safe.
Conclusion
The KelpDAO rsETH exploit combines three of DeFis biggest risk vectors: bridge contracts, composability and leveraged restaking. One flawed cross chain mint operation cascaded into hundreds of millions of dollars in losses, frozen markets and new bad debt. How leading protocols handle this cleanup will shape market trust in restaking collateral and cross chain DeFi design for the rest of this cycle.
CoinsKid.Com