A suspected exploit tied to Kelp DAO’s rsETH cross-chain bridge has spread into a broader DeFi crisis. On-chain tracking cited in the source showed roughly 116,500 rsETH leaving custody, with an estimated value of about $292 million. What began as a bridge incident quickly touched lending, restaking, and exchange risk controls.
Kelp DAO said it paused core contracts about 46 minutes after the activity was detected and blocked later attempts while investigating with LayerZero and Unichain. Based on the information published so far, the issue appears linked to the application’s message path and trust configuration, not to a confirmed protocol-wide flaw in LayerZero itself.
Attention turns to key security and validator setup
Early commentary focused on a failure in the message verification path. Security analysis cited in the report suggested the setup may have relied on a 1-of-1 DVN instead of a safer 2-of-2 default arrangement. If that was the case, one compromised signer could have created a direct single point of failure.
Some reports linked the root cause to a leaked or stolen source-chain private key. Analysts said a trusted node identified as Kelp DAO may have sent the message that triggered an lzReceive call, releasing the 116,500 rsETH from custody. That is why investigators are looking beyond bridge code and examining node trust and private key handling.
Aave was not hacked, but became the main stress point
Aave emerged as the center of market concern even though it was not the protocol breached. According to the source, after the Kelp DAO bridge exploit on April 18, 2026, the attacker used the asset as collateral on Aave and borrowed large amounts of ETH. Aave then froze rsETH markets on V3 and, from 18:52 UTC, on V4 launches as well. It also froze WETH reserves in affected markets across Ethereum, Arbitrum, Base, Mantle, and Linea.
Stani Kulechov said the lost borrowing power came from an exploit outside Aave. The protocol’s analysis found that rsETH on Ethereum mainnet remains fully backed, though rsETH and some WETH reserves remain frozen in affected markets as a safeguard. The report also said Aave Token saw more than $5.4 billion in outflows.
Mainnet backing may still be intact, but users moved quickly to withdraw funds. That pushed utilization rates higher and tightened DeFi liquidity. If the collateral cannot fully cover the borrowed ETH, Aave would be left with bad debt. Current reports in the source place that exposure at roughly $177 million to $200 million, while the final loss to be absorbed by Aave DAO remains unconfirmed.
Lido Earn, Morpho, Kamino and exchanges also reacted
The fallout spread well beyond one lending venue. Lido Earn suspended earnETH deposits because of rsETH exposure. Kamino shifted some LayerZero-linked assets into withdrawal-and-repayment-only mode. Morpho paused its OFT bridge on Arbitrum. On the exchange side, Upbit and Bithumb warned KernelDAO holders about volatility.
Curve founder Michael Egorov used the episode to highlight the risks tied to non-isolated lending pools. That debate now sits at the center of DeFi risk design. The source noted that if losses remain concentrated on Layer 2 markets, those chains may face the deepest strain. If losses are distributed more broadly, contagion risk could ease, though the governance cost may rise.
Loss allocation is now the key question
For rsETH, the next issue is how losses are allocated. The source says rsETH on Ethereum mainnet is still backed, which may limit damage in the core market. Even so, frozen markets, bridge pauses, and exchange alerts show how fast a cross-chain failure can hit lending activity and drain liquidity. Traders are now watching remediation plans, insurance backstops, and governance decisions.