Lido has halted deposits and withdrawals on its EarnETH vault after the Kelp security incident hit one of the vault’s underlying exposures. The pause is tied to two issues at once: direct exposure to rsETH, the token linked to the incident, and rising stress inside lending markets that has weighed on the vault’s looping positions.
About 9% of the vault is linked to rsETH
Lido said roughly 9% of EarnETH’s total assets are tied to rsETH. That share is not dominant, but it was large enough for curators to stop flows while they determine whether any losses will remain after recovery efforts. The Arbitrum Security Council has already recovered around $70 million in ETH connected to the attack, and more recovery work is still underway. Final loss figures have not been settled.
Lending-market pressure created a second source of strain
The vault’s problems are not limited to the Kelp-linked token exposure. Elevated borrowing rates across lending venues have also pressured looping strategies inside EarnETH that are unrelated to the breach itself. Lido said curators have been deleveraging those positions, and that rapid action has already cut outstanding wETH debt by a significant amount. A broader update is expected soon.
The DAO treasury’s first-loss capital may absorb damage first
If losses are confirmed, Lido has a protection layer in place. The Lido DAO treasury holds a $3 million first-loss position inside the EarnETH vault, set up specifically to shield regular depositors in events like this. Under that structure, the DAO’s vault shares would be burned first to absorb losses before ordinary users take the hit.
Lido governance approved the arrangement earlier this year as part of the effort to make the Earn product credible enough to scale. This week’s disruption is the first real trial of that design.
The incident spread across multiple DeFi layers
The Kelp breach shows how quickly risk can move through interconnected DeFi systems. What started as a protocol security problem has already reached restaking tokens, lending-market liquidity, and yield-vault strategies across separate platforms. Lido’s immediate task is to contain the fallout and restore normal vault operations.