DeFi exploit locks users out of withdrawals

TLDR

A major exploit of Kelp DAOs rsETH token has cascaded into DeFi lending markets, temporarily locking some users out of withdrawals on platforms such as Aave.

1. Attackers stole roughly $292 million of rsETH via a cross chain bridge exploit, then used it as collateral across lending protocols including Aave.
2. On Aave, stolen rsETH collateral and panic withdrawals pushed key markets to 100% utilization, so many depositors could not withdraw despite contracts remaining intact.
3. Recovery now depends on Kelp DAOs investigation, potential bad debt resolution on Aave, and whether confidence returns to DeFi money markets and cross chain bridges.

Deep Dive

1. How The Exploit Happened

Kelp DAO, a liquid restaking protocol for rsETH, suffered a bridge exploit where an attacker spoofed a cross chain message on LayerZero infrastructure, releasing 116,500 rsETH worth about $292 million, roughly 18% of supply, into their control according to multiple reports from Yahoo Finance and Crypto Briefing.

The attacker then deposited the unbacked rsETH into lending protocols such as Aave V3 and borrowed large amounts of wrapped ETH and other assets against it, creating over $200 million in bad debt across venues.

Kelp DAO responded by pausing rsETH deposits and withdrawals across Ethereum mainnet and several layer 2 networks while it investigates with LayerZero, auditors, and security firms.

2. Why Withdrawals Were Locked

Because the rsETH collateral was effectively worthless after the exploit, positions on Aave became unliquidatable, leaving the protocol with WETH obligations it could not recover in the usual way, as detailed by Bitcoin.com.

As users rushed to exit, Aaves ETH and WETH markets saw billions in net outflows, with some pools hitting 100% utilization, meaning all supplied liquidity was borrowed and suppliers could not withdraw until loans are repaid or backstops intervene, a dynamic highlighted by Decrypt.

Aave froze rsETH markets, removed its borrowing power and emphasized that its own contracts were not exploited, but the combination of bad debt and full utilization still left many lenders temporarily stuck.

3. What To Watch Next

Kelp DAO is working on a root cause analysis and potential remediation, while Aaves Umbrella backstop and governance process are expected to decide how to absorb an estimated $177$200 million in bad debt and restore normal withdrawals.

Sector wide, the incident has triggered heavy outflows from other money markets and renewed scrutiny of cross chain modular security, with developers warning about single points of failure in bridge configurations as covered by CoinDesk.

For individual users, the key signals are official notices from affected protocols, utilization levels on lending pools, and any governance proposals detailing loss socialization, insurance use, or protocol parameter changes.

Confidence: high, as multiple independent news and analytics sources are consistent on the exploit mechanism, amounts, and liquidity effects.

Conclusion

A cross chain bridge failure at Kelp DAO has rippled into core DeFi money markets, showing how a single design flaw can freeze withdrawals for users who were never directly hacked. The next phase will be defined by how quickly protocols resolve bad debt, adjust risk frameworks for collateral and bridges, and whether users regain enough confidence to re supply liquidity into DeFi lending.