TLDR
A cross-chain exploit of Kelp DAOs rsETH token drained over $290 million across Ethereum-based DeFi, triggering protocol freezes and a sharp liquidity shock.
- An attacker abused Kelp DAOs LayerZero-based bridge to mint ~116,500 unbacked rsETH (about $292 million) and drain real ETH from lending markets.
- The stolen rsETH was used as collateral on Aave, Compound and others, creating large bad debt and helping drive a roughly 10 percent one-day drop in overall DeFi TVL.
- The incident highlights structural risk in cross-chain and restaking tokens; users should watch for recovery plans, parameter changes, and stricter rate limits on bridges and collateral.
Deep Dive
1. How The $290M Exploit Worked
Kelp DAOs rsETH is a liquid restaking token representing staked Ethereum that users can move across chains and into DeFi.
Reports say the attacker exploited Kelps LayerZero-powered cross-chain bridge, forging a message that the system treated as valid and causing it to release about 116,500 rsETH, worth roughly $292 million, to an attacker wallet. This represented around 18 percent of rsETHs circulating supply.[^1]
The attacker then deposited the unbacked rsETH into lending protocols like Aave V3, Compound V3 and Euler to borrow real ETH and WETH, effectively turning fake collateral into real assets.[^2] Ethereum itself was not hacked; the weakness was in the bridge and verifier configuration on top of Ethereum and Arbitrum.
Infrastructure and bridge logic, not the base chain, are often the real attack surface in DeFi.
2. Impact On Aave, DeFi TVL And Sentiment
Because rsETH was widely accepted as collateral, the exploit quickly propagated through DeFi. Aave froze rsETH markets on its V3 and V4 deployments and now faces significant bad debt from loans backed by the fake rsETH.[^2][^3]
Analysts estimate that the Kelp incident drove Aaves total value locked down by roughly 20 percent and contributed to a sector-wide DeFi TVL drop of about $10.6 billion (around 10 percent) within 24 hours.[^3][^4] Aaves token fell double digits on the news, and several protocols including Spark, Fluid and Lidos earnETH product paused or adjusted products with rsETH or related exposure.[^2][^4]
Sentiment around DeFi turned more bearish, with some commentators calling 2026 potentially the worst year on record for hacks.[^2]
The blast radius shows how one misconfigured asset can stress multiple blue chip DeFi protocols at once.
3. Systemic Risks And What To Watch
Post-mortems point to a single point of failure verifier setup and missing rate limits on cross-chain minting, rather than a traditional smart contract bug.[^2][^5] Experts argue that modular cross-chain designs need stronger minimum security standards and hard caps on how much value can move or be minted in a short period.
Key things to monitor now:
- Kelp DAOs recovery plan (potential clawbacks, treasury usage, or negotiations with affected protocols).
- Governance proposals on Aave and other money markets around bad-debt handling and stricter listing criteria for restaking tokens.
- Industry-wide adoption of rate limits and multi-verifier setups for bridges and OFT-style tokens.[^5]
If large protocols enforce tighter caps, future exploits may still occur but are more likely to be tens of millions, not hundreds of millions.
Conclusion
This exploit did not compromise Ethereum itself but exposed how fragile highly interconnected DeFi and restaking stacks can be when a single bridge or verifier is misconfigured. For users, the main takeaway is to treat complex cross-chain and restaking collateral as higher risk and to watch how leading protocols respond with rate limits, collateral standards and governance decisions in the coming weeks.
[^1]: Kelp DAO rsETH bridge exploit details [^2]: Yahoo overview of the Kelp DAO exploit and Aave response [^3]: Aave TVL impact and bad-debt estimates [^4]: Sector-wide DeFi TVL drop [^5]: Coindesk analysis of systemic cross-chain risks
CoinsKid.Com