DeFi lenders reel after $292M cross-chain exploit

TLDR

A $292 million exploit of Kelp DAOs rsETH cross-chain bridge has hit major DeFi lenders and reignited concerns about cross-chain security.

1. An attacker forged cross-chain messages on Kelp DAOs LayerZero-based bridge, minting 116,500 unbacked rsETH and using it as collateral on Aave to drain real ETH.
2. Aave and other lenders froze rsETH markets, saw billions exit, and now face hundreds of millions in bad debt, sparking worries about systemic risk across Ethereum lending.
3. Developers are pushing for stricter bridge configurations, rate limits, and collateral caps, while the industry watches for forensic findings, recovery plans, and governance decisions on who eats the losses.

Deep Dive

1. How The Exploit Worked

Kelp DAOs rsETH is a liquid restaking token backed by staked ETH and bridged across chains using LayerZero infrastructure. Investigations say Kelp used a highly centralized, single-verifier style setup on its bridge, allowing a forged message to be treated as valid input to release funds.

The attacker crafted fraudulent cross-chain messages and unlocked 116,500 rsETH, about 18% of supply, worth roughly $292 million, from Kelps bridge without real burns or deposits on the source chain. Reports from TokenPost and others describe this as a message spoofing or single-signer failure on the LayerZero-based bridge, not a bug in core Ethereum or Aave contracts.

The unbacked rsETH was then deposited as collateral on Aave V3 and other money markets to borrow large amounts of Wrapped Ether (WETH). Because the rsETH is no longer backed by real ETH, these positions cannot be cleanly liquidated, leaving Aave with an estimated $236 million-plus in bad debt tied to worthless collateral.

2. Damage To DeFi Lenders

The immediate response was defensive. Aave froze rsETH markets on V3 and V4 and disabled borrowing for the asset while it assesses the shortfall, emphasizing that Aaves own contracts were not directly exploited. Lending peers such as Spark, Compound, Euler, Fluid, Pendle, Beefy and Yearn either paused or sharply limited rsETH exposure.

Liquidity rushed out. Coverage from CoinDesk describes deposits on Aave dropping from around 26.4 billion dollars to near 20 billion dollars in short order, while AAVEs token price fell in the mid-teens percent range as markets priced in bad debt and tail risk.

Because rsETH was widely used as collateral and yield input across more than twenty networks, this one break in Kelps bridge is rippling across much of Ethereum DeFi, reinforcing the narrative that composability without strong risk isolation can turn into systemic contagion when a core asset fails.

3. Reforms And What To Watch

Kelp DAO has paused rsETH contracts across Ethereum mainnet and multiple layer 2s and is working with LayerZero, Unichain, auditors and security firms on a full root-cause report and recovery options. Tron founder Justin Sun has publicly urged the attacker to negotiate a partial return, warning that unrecovered losses at this scale could be fatal for both Kelp and Aave.

Elsewhere, infrastructure and protocol teams are racing to harden their setups. BitGo and partners temporarily disabled some LayerZero DVN configurations for Wrapped Bitcoin as a precaution, while Polygon, Katana and others reviewed or paused certain bridge paths even where they reported no direct impact. Builders like Ethena and Monad are advocating strict rate limits on cross-chain minting and dynamic collateral caps, arguing that these would have limited Kelps losses to tens of millions rather than nearly three hundred million.

For users and governance participants, key things to watch are: upcoming forensic reports on exactly how the signing keys or DVN were compromised, Kelps plan for making rsETH holders and lenders whole, and Aave governance proposals around socializing or covering bad debt. Longer term, attention will focus on whether major lenders tighten collateral listings for bridged and restaking tokens or demand stricter minimum security standards.

Conclusion

A single misconfigured cross-chain bridge at Kelp DAO allowed an attacker to mint unbacked rsETH and convert it into real ETH via Aave, turning a bridge bug into protocol-level bad debt. The fallout shows how deeply interconnected DeFi money markets have become, with one restaking token incident sending shockwaves across lending platforms and investor confidence. The next phase will hinge on how quickly infrastructure standards, collateral policies and governance responses adapt, and whether the sector can turn this crisis into stronger, more conservative security practices.