Kelp DAO was hit by what the source describes as the largest DeFi security incident of 2026 so far. An attacker exploited a LayerZero cross-chain bridge configuration weakness and withdrew 116,500 rsETH, worth about $292 million at the time. That amount represented roughly 18% of rsETH’s 630,000-token circulating supply. The fallout quickly spread beyond Kelp, forcing market freezes across Aave, SparkLend, Fluid, and Upshift.
Freeze came 46 minutes after the initial exploit
The attack began at 17:35 UTC. According to the report, the attacker forged what appeared to be a valid instruction from another network, causing Kelp’s bridge contract to release rsETH to an address under the attacker’s control. Kelp’s emergency pause multisig did not complete the freeze until 18:21 UTC, a delay of 46 minutes.
The attacker then tried twice more, at 18:26 and 18:28, to extract another 40,000 rsETH, or around $100 million. Both attempts failed and reverted. KernelDAO issued its first X statement at 20:10 UTC, saying it was investigating with LayerZero, Unichain, auditors, and external security specialists. No detailed explanation of how the bridge verification logic was bypassed had been published at that point.
Investigators point to DVN configuration rather than contract code
External investigators said the root cause was not a bug in the smart contract code itself. Instead, they traced the incident to a problem in LayerZero’s DVN, or decentralized verifier network, configuration. A gap in the validator setup allegedly allowed forged cross-chain messages to pass as legitimate instructions.
That matters because rsETH uses LayerZero’s OFT standard across more than 20 chains, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll. Once the bridge reserves were drained, the backing behind wrapped rsETH across those networks came under immediate pressure. The main question shifted to whether rsETH could hold its peg.
Stolen rsETH was posted on Aave as collateral
The heaviest secondary impact showed up on Aave. The attacker did not sell the stolen rsETH right away. Instead, the assets were deposited into Aave as collateral to borrow large amounts of WETH, with funds then routed through Tornado Cash. As rsETH fell, the collateral value dropped fast, and liquidations failed to absorb the losses because liquidity had thinned out.
Aave’s bad debt is now estimated at $177 million to $200 million. The protocol’s WETH borrowing pool utilization briefly hit 100%, daily outflows exceeded $5.4 billion, and total value locked fell by about $6.6 billion, a 24.11% drop. The AAVE token fell more than 17.7% intraday. Founder Stani Kulechov said the event was external and that Aave’s own contracts were not compromised.
Other protocols reacted as rsETH backing came into focus
SparkLend and Fluid froze their rsETH markets. Lido Finance paused new deposits into its earnETH product where there was rsETH exposure, while saying stETH and wstETH were unaffected and that Lido’s core staking protocol was unrelated to the incident. Ethena temporarily paused the LayerZero OFT bridge on Ethereum mainnet for about six hours and said its stablecoin remained overcollateralized above 101% with no rsETH exposure.
The next phase depends on two things cited in the source: whether holders rush to redeem cross-chain rsETH positions, and whether Kelp can recover any assets before Tornado Cash routing makes tracing and recovery harder. Based on the facts disclosed so far, the incident has exposed the fragility of bridge validation settings, multi-chain asset backing, and the dependence of lending protocols on external collateral quality.