TLDR
Liquid restaking protocol KelpDAO was hit by an exploit of roughly $292 million that drained rsETH-backed liquidity across major DeFi lending markets.
- Attackers abused KelpDAO's LayerZero-based cross-chain bridge to mint unbacked rsETH and drain about 116,500 rsETH, worth roughly $292 million, from collateralized positions.
- The fake rsETH was used as collateral on protocols like Aave, Compound, Euler and others, creating over $200 million in bad debt and forcing platforms to freeze rsETH markets.
- The incident exposes systemic risks in liquid restaking and cross-chain infrastructure, and users should closely monitor responses from KelpDAO, Aave and other affected protocols before assuming risks are contained.
Deep Dive
1. How The Exploit Worked
KelpDAO issues rsETH, a liquid restaking token that represents ETH deposited into EigenLayer for extra yield.
According to multiple reports, attackers manipulated KelpDAO's LayerZero-powered cross-chain bridge, tricking the messaging layer into approving fraudulent transfers and releasing 116,500 rsETH from Kelp's bridge reserves, about 18 percent of rsETH supply, for an estimated $292 million loss. This is described as the largest DeFi hack so far this year in coverage of the Kelp DAO bridge hack and cross-chain exploit details.
Crucially, the core rsETH and Aave contracts were not directly broken. The attacker instead created or unlocked unbacked rsETH via the bridge, then used it as if it were legitimate collateral.
2. Impact On DeFi Liquidity
The attacker deposited the bogus rsETH into lending protocols including Aave V3, Compound V3, Euler, Fluid, SparkLend and others, then borrowed large amounts of WETH and other assets, leaving more than $236 million in bad debt spread across platforms, as outlined in incident analyses and follow up coverage.
Aave froze rsETH markets on V3 and V4 and warned of potential nine figure bad debt exposure, while Lido paused deposits to its rsETH-exposed earnETH product but confirmed stETH itself was unaffected. Other protocols similarly halted rsETH activity to stem contagion.
Liquidity tied to rsETH and its lending markets is impaired, so users with rsETH, rsETH LP tokens, or rsETH backed loans face elevated risk of frozen markets and impaired collateral value.
3. Risks And What To Watch
This exploit highlights two structural risks. First, liquid restaking tokens like rsETH are deeply integrated as collateral across many protocols, so a single failure can ripple into a cross protocol liquidity crunch. Second, the root cause lies in configurable cross-chain infrastructure, where one misconfigured verification path on LayerZero allowed an attacker to bypass assumptions about reserves, as emphasized in several post mortem style reports.
Security researchers and DeFi builders are calling for stricter standards on what assets can be used as collateral, more isolated lending design, and much more conservative use of cross-chain bridges for core collateral.
Until KelpDAO, LayerZero and major lending protocols publish and implement concrete remediation plans, the broader restaking and cross-chain DeFi stack should be treated as higher risk, especially where non-blue-chip collateral is involved.
Conclusion
A configuration level exploit in KelpDAO's cross-chain bridge allowed attackers to mint or unlock roughly $292 million worth of unbacked rsETH, and its widespread use as collateral turned a single-point failure into sector wide bad debt. The episode underscores how liquid restaking and cross-chain composability amplify both yield and systemic risk, and it shifts the burden onto protocols to harden bridge security and collateral onboarding before confidence can fully return to restaking heavy DeFi strategies.
CoinsKid.Com