Cross-chain exploit drains $292M from DeFi

TLDR

A $292 million exploit of Kelp DAOs rsETH cross-chain bridge has triggered one of the largest DeFi security crises so far this year.

1. An attacker abused Kelp DAOs LayerZero-based bridge to mint unbacked rsETH and drained around 116,500 tokens, worth about $292 million.
2. The stolen rsETH was used as collateral on major lending protocols like Aave, creating over $200 million in bad debt and forcing multiple platforms to freeze markets.
3. The incident exposes structural risks in cross-chain DeFi and restaking, and users should closely track bridge design, collateral choices, and protocol risk controls.

Deep Dive

1. How The $292M Exploit Worked

Kelp DAOs rsETH is a liquid restaking token that represents staked ETH and is bridged across chains using LayerZero infrastructure.

Investigators report that the attacker forged or spoofed cross-chain messages so the bridge released rsETH on destination chains without burning corresponding tokens on the source chain, effectively minting unbacked rsETH worth about $292 million, roughly 18 percent of rsETH supply.Kelp DAO bridge exploit drains $292M

Analyses point to a highly centralized or single-signer verification setup in Kelps bridge configuration, which meant compromising one verification path was enough to bypass safety checks.The $292 million Kelp exploit

2. Contagion Across DeFi Lending

After minting unbacked rsETH, the attacker deposited it as collateral into lending protocols, most prominently Aave V3, and borrowed large amounts of ETH and other assets.Kelp attack spreads risk across DeFi

Because the rsETH backing this debt is now effectively worthless, Aave and peers are stuck with bad debt that cannot be liquidated. Estimates suggest more than $236 million in bad debt on Aave alone, with total ecosystem bad debt above $280 million.Kelp DAO bridge exploit drains $292M

Aave, Spark, Compound, and others have frozen rsETH markets or related products to contain risk, while Kelp DAO paused rsETH contracts across mainnet and several layer 2s.Kelp DAO rsETH exploit triggers DeFi freezes

3. What DeFi Users Should Watch

1. Bridge and oracle design: Single-signer or highly centralized verification for cross-chain messages is now a clear red flag. Look for multi party validation, rate limits, and explicit security docs.
2. Collateral policies: Lending protocols that rapidly list new restaking or bridged assets without strict caps or isolation can be vulnerable to similar fake collateral attacks.
3. Risk controls and governance: Market freezes, caps, and emergency modules matter. Protocols with transparent incident playbooks and conservative listing frameworks are better positioned to contain contagion.The $292 million Kelp exploit

Conclusion

A single flawed cross-chain bridge at Kelp DAO allowed an attacker to create fake rsETH at scale, turning into real losses when that collateral was used across DeFi lending. The episode shows how composability and restaking can amplify a configuration mistake into ecosystem wide bad debt, making bridge security, collateral selection, and conservative risk limits central topics for anyone active in DeFi.