Kelp DAO's rsETH cross-chain bridge was hit by a $292 million exploit, with 116,500 rsETH tokens siphoned — 18% of the circulating supply. It marks the largest DeFi loss in 2026 so far, surpassing the $285 million Drift Protocol incident.
LayerZero Message Forgery Exploited
The attacker exploited LayerZero's cross-chain messaging infrastructure by forging a fake verification message. Kelp's bridge contract mistakenly believed a legitimate transfer request existed on another chain and released rsETH to the hacker's wallet. Kelp DAO immediately suspended deposits and withdrawals on both mainnet and all Layer 2 networks.
Borrowed 74,000 ETH to Create Bad Debt
Instead of cashing out, the attacker deposited the stolen rsETH into Aave V3, Compound V3, and Euler, borrowing roughly 74,000 ETH as collateral. This created over $236 million in debt positions across protocols, bringing total bad debt to more than $280 million.
Cascading Freezes Hit Multiple Protocols
Aave froze its V3 and V4 rsETH markets, stating the issue was specific to rsETH, not Aave itself. SparkLend and Fluid followed suit. Lido paused earnETH deposits due to rsETH exposure. Ethena, though not directly exposed, preemptively halted its LayerZero bridging on Ethereum. Onchain sleuth ZachXBT is tracking the stolen funds and assessing links to known hacker groups.
Kelp DAO has not yet disclosed a remediation plan. The restaking sector faces trust concerns, with all protocols relying on cross-chain bridges rethinking security postures.