Kelp DAO’s rsETH restaking system became the center of the largest DeFi exploit reported in 2026 after an attacker manipulated a cross-chain component and minted roughly 116,500 rsETH between April 17 and April 19. The exploit allowed an estimated $292 million to $294 million to be extracted from connected DeFi rails, turning a single bridge failure into a market-wide liquidity shock.
The breach originated in the rsETH adapter bridge, a LayerZero-powered cross-chain mechanism that appears to have been used to forge a message and create unbacked rsETH supply. On-chain evidence showed the attacker effectively minted the tokens out of thin air, with the forged amount equal to about 18% of rsETH’s circulating supply, making the inflation of collateral itself the core engine of the exploit.
The rsETH markets on Aave V3 and Aave V4 have been frozen. Aave's contracts have not been exploited and this is an exploit related to rsETH.
The freeze follows an exploit of the Kelp DAO rsETH bridge. Freezing the rsETH markets prevents new deposits and borrowing against rsETH…
— Aave (@aave) April 18, 2026
How the Attack Spread Across Lending Markets
Once the attacker had the synthetic rsETH, the tokens were posted as collateral across DeFi lending venues and used to withdraw real ETH. A large share of the proceeds was then converted into ETH, while chain data indicated the attacker’s wallet had been funded through Tornado Cash before the exploit, reinforcing the view that the operation was prepared in advance rather than improvised in the moment.
Kelp DAO moved to halt rsETH activity after the abnormal transfers were detected, but by then the impact had already spread across major markets. The inflated collateral flowed into Aave V3 on both Ethereum and Arbitrum, where frozen rsETH markets prevented liquidations from functioning normally and left the system with large uncovered positions, showing how quickly false collateral can become real bad debt in composable lending systems.
🚨 $293M EXPLOIT DETECTED: Cyvers AI systems have identified a massive attack on @KelpDAO .
Our platform flagged the breach in real-time, tracking ~$293.7M drained from the protocol's RSETH Adapter. Currently, ~$250M has already been swapped to $ETH and is held across two… pic.twitter.com/E2bnoZh0Eu
— 🚨 Cyvers Alerts 🚨 (@CyversAlerts) April 18, 2026
The Damage Extended Well Beyond Kelp DAO
The consequences for Aave were severe. The exploit triggered more than $5.4 billion in ETH withdrawals from Aave pools and left the protocol facing an estimated $177 million to $200 million in unrecoverable loans, turning the incident into a direct test of DeFi’s ability to absorb systemic collateral failure.
The contagion did not stop there. At least nine other protocols were affected, and several of them, including Compound, Fluid, SparkLend and Euler, paused rsETH markets or introduced emergency controls to contain the damage. That response made clear that the real weakness was not only in one protocol’s bridge logic, but in the broader habit of treating bridged collateral as safely portable across multiple platforms.
What the Exploit Means for DeFi Going Forward
The Kelp DAO incident has crystallized a specific structural risk inside modern DeFi: cross-chain verification failures can create unbacked assets that travel through lending markets faster than risk controls can respond. For traders, treasuries and governance participants, the lesson is immediate, because liquid-staking derivatives and bridged assets now carry a more obvious counterparty and liquidity risk than many markets had priced in.
The next phase will depend on forensic tracing, bad-debt accounting and whatever recovery or compensation frameworks affected protocols can coordinate in the aftermath. Developers and market participants are already calling for tighter bridge verification and a rethinking of non-isolated lending design, but the deeper message is harder to ignore: DeFi’s composability remains powerful, yet it can also turn one verification flaw into a system-wide solvency event.
