DeFi hack drains $292M and jolts lending

TLDR

A $292 million exploit of Kelp DAOs rsETH bridge has become 2026s biggest DeFi hack and triggered a liquidity crunch across major lending platforms.

1. Attackers spoofed a LayerZero cross-chain message to drain about 116,500 rsETH (around 18% of supply) from Kelp DAOs bridge.
2. The stolen rsETH was used as collateral on Aave and other lenders, creating large bad debt, maxing out ETH utilization and causing sharp TVL and token price drops.
3. The incident exposes systemic risks from cross-chain bridges and liquid restaking collateral, and is likely to push DeFi toward stricter collateral and bridge security standards.

Deep Dive

1. How The $292M Exploit Worked

Reports say Kelp DAOs rsETH bridge, built on LayerZero, was hit by a cross-chain messaging exploit that let the attacker fabricate a valid transfer instruction. In response, the bridge released about 116,500 rsETH, worth roughly 292 million dollars, to an attacker controlled wallet, representing around 18% of rsETHs circulating supply on Ethereum and L2s such as Arbitrum and Base.

Analyses from several outlets describe this as a message spoofing or misconfigured verification issue in LayerZero based infrastructure rather than a bug in rsETHs core token contract itself, turning rsETH into effectively unbacked tokens on the exploited leg of the bridge.

2. Shock To Aave And DeFi Lending

After draining rsETH, the attacker deposited the tokens as collateral on Aave V3 (and also on Compound, Euler and others) and borrowed large amounts of ETH and wrapped ETH, accumulating over 230 million dollars of debt positions. Because the rsETH backing was lost at the bridge, these loans are effectively uncollateralized, leaving lenders with protocol level bad debt.

Coverage on Aave notes its ETH pool hit 100% utilization and that total value locked dropped from about 26.4 billion dollars to near 20 billion, while the AAVE token fell roughly 10 to 18 percent as markets reacted. Multiple protocols, including Aave, SparkLend, Fluid and others, froze rsETH markets or related positions to stop further contagion and are now assessing how much of the loss must be socialized versus covered by reserves.

3. Systemic Risks And What To Watch

Commentary across the industry highlights three structural issues: cross-chain bridge security, non isolated lending markets, and the growing use of complex liquid restaking tokens like rsETH as collateral in leveraged setups. Because rsETH was deeply integrated across more than twenty networks and many protocols, one exploit immediately became a cross protocol contagion event instead of a contained bridge failure.

In the near term, key things to watch are: updated post mortems and responsibility sharing between Kelp DAO, LayerZero and affected lenders; governance decisions on whether stkAAVE or other backstops absorb bad debt; and whether risk frameworks tighten around bridge backed and restaking collateral. A sustained drop in rsETH liquidity or a persistent discount versus its intended value would be another sign that confidence in this design has been damaged.

Conclusion

The Kelp DAO rsETH exploit shows how a single cross-chain validation failure can mint fake collateral at scale and export the damage into major lending platforms. Aave and peers are now stress testing their safety modules and collateral policies under real loss, not just simulations. For DeFi users, the episode underlines that bridge risk and exotic collateral choices can matter just as much as headline protocol audits when assessing where to lend or borrow.