Restaking hack wipes $293M and rattles DeFi

TLDR

A major exploit on Kelps rsETH restaking token drained around $293 million and exposed how interlinked DeFi protocols can share the same single point of failure.

1. Kelps rsETH bridge was exploited to create unbacked tokens, which were used across lending protocols, leading to roughly $293 million in losses and bad debt.
2. The attack spread risk across at least nine DeFi protocols, forcing Aave and others to freeze rsETH markets and intensifying concerns about liquid restaking and cross?chain bridges.
3. The next phase hinges on how quickly protocols ring?fence bad debt, whether more bugs are discovered, and how regulators and users react to another record?scale DeFi hack.

Deep Dive

1. What Actually Happened

Kelp, a liquid restaking protocol for Ethereum, reported that its rsETH adapter bridge contract was exploited, with security firm Cyvers estimating a loss of about $293 million from rsETH reserves. The attacker abused the cross?chain bridge logic (via LayerZero messaging) to release 116,500 rsETH, then swapped much of it into ETH and moved funds through Tornado Cash, according to detailed post?mortems and on?chain analysis. Reports note that these unbacked rsETH tokens were then deposited into lending markets like Aave V3 and Compound V3 to borrow real assets, leaving large pools of bad debt once the collateral was recognized as compromised, making this the largest DeFi exploit of the year so far.

2. Why It Rattles DeFi

This was not just one app losing funds. Coverage describes a cross?protocol contagion as at least nine protocols with rsETH exposure froze or restricted markets, including Aave pausing rsETH on V3 and V4 and Lido adjusting products that touched rsETH. Because rsETH represents staked ETH restaked through EigenLayer and then reused as collateral, a flaw in one piece of infrastructure created systemic risk across lending, yield and bridge products that integrated it. Analysts highlight that this comes on top of recent large exploits such as the Drift Protocol hack, reinforcing fears that complex composability in DeFi can magnify single contract failures into ecosystem?wide events.

3. What To Watch Next

Key questions now are how much of the bad debt can be contained or socialized, and whether forensic work uncovers deeper design issues in rsETH, LayerZero messaging, or integrated protocols. For users, the relevant checks are exposure to rsETH or Kelp?linked markets on Aave, Compound and similar platforms, plus any governance proposals that change risk parameters or haircut mechanisms. On a market level, repeated large exploits can push institutions and regulators to demand stricter audits and risk limits on restaking and cross?chain collateral, which could slow growth but improve robustness.

Conclusion

The Kelp rsETH exploit shows how lucrative but complex restaking and cross?chain designs can turn a single contract flaw into hundreds of millions in losses and multi?protocol stress. How quickly DeFi risk managers isolate bad debt and tighten standards will determine whether this shock becomes a turning point toward safer designs or simply another warning that goes unheeded.