TLDR
A cross-chain bridge used by KelpDAOs rsETH token was exploited, creating roughly $292M of unbacked liquidity and triggering a sharp DeFi-wide funding squeeze.
- An attacker forged cross-chain messages on KelpDAOs LayerZero-powered rsETH bridge, minting about 116,500 unbacked rsETH worth roughly $292M.
- The fake rsETH was deposited on lending platforms like Aave as collateral to borrow real ETH and stablecoins, leaving protocols with large bad debt and frozen markets.
- DeFi users now face higher systemic risk from bridge and restaking infrastructure, with projects reassessing cross-chain setups and collateral onboarding standards.
Deep Dive
1. What Was Hacked And How
KelpDAOs rsETH is a liquid restaking token issued against staked ETH. On 18 April, an attacker exploited a misconfigured LayerZero-based bridge, forging cross-chain messages so the bridge released rsETH without burning tokens on the source chain. Reports estimate about 116,500 rsETH, roughly 18 percent of supply and about $292M, were created this way, making it one of 2026s largest DeFi exploits. Coverage notes the root cause was a single-signer or 1-of-1 verifier configuration that let one compromised key approve bridged messages, rather than a robust multi-party verification setup.
The problem was not Ethereum itself but a weakly configured cross-chain layer sitting on top, which became a single point of failure.
2. How It Drained Liquidity Across DeFi
Once the attacker had the unbacked rsETH, they deposited it as collateral on major lending protocols, primarily Aave, to borrow large amounts of ETH, WETH and stablecoins. Because the collateral was effectively worthless, Aave is left with an estimated $177M to $236M in bad debt and markets for rsETH and related assets were frozen. Articles describe more than $6B withdrawing from Aave within about a day, pushing key pools like ETH, USDT and USDC to 100 percent utilization, which trapped remaining depositors and made withdrawals very difficult. DeFi total value locked reportedly fell by over $10B as capital fled lending and restaking protocols.
Even protocols that were not directly exploited can suffer when collateral they accept becomes toxic, leading to liquidity freezes and impaired withdrawals.
3. Systemic Risks And What To Watch
Security researchers highlight that this exploit came after other large 2026 hacks and is part of a pattern where cross-chain bridges and complex restaking setups introduce hidden systemic risks. LayerZeros preliminary analysis suggests a sophisticated state actor may be involved, but the key technical lesson is about configuration, governance and collateral standards rather than attribution. In response, multiple projects have paused rsETH markets or LayerZero-based bridges and are reviewing cross-chain validation rules and asset onboarding. Users should watch for: post-mortems from KelpDAO and LayerZero, how Aave decides to cover bad debt, and whether other protocols tighten collateral rules for liquid staking and restaking tokens.
The incident is a wake-up call that bridge design and collateral policies are now as important to DeFi safety as individual protocol code audits.
Conclusion
A configuration flaw in KelpDAOs LayerZero-based bridge allowed an attacker to mint unbacked rsETH, turning a single technical weakness into a sector-wide liquidity crisis. By using the fake tokens as collateral on lending platforms, the exploit converted a bridge bug into real bad debt and trapped depositors, underlining how tightly coupled DeFi has become. Going forward, the main questions are whether cross-chain security standards and collateral onboarding will be tightened enough to prevent similar systemic shocks.
CoinsKid.Com