0:00
0:00
Subscribe to Bankless or sign in
An attacker drained 116,500 rsETH from Kelp DAO’s cross-chain bridge on Saturday, marking one of the largest exploits of the year. The protocol halted further losses within an hour, but the incident is already rippling across DeFi.
What’s the Scoop?
- Exploit details: The attacker triggered a
LayerZero EndpointV2 call that released 116,500 rsETH, worth about $292M, to an attacker-controlled wallet funded via Tornado Cash. - Bridge vector: The exploit appears tied to Kelp’s LayerZero OFT bridge, which enables rsETH transfers across a number of networks.
Aave exposure: Aave froze rsETH markets on V3 and V4 and is assessing potential bad debt, stating it may need to explore ways to cover any deficit. The stolen amount represents roughly 18% of rsETH supply; AAVE token fell about 10% following the incident.
rsETH has been frozen on Aave V3 and V4, the asset does not have any borrowing power as a measure due to
— Stani (@StaniKulechov) April 18, 2026KelpDAO bridge exploit that happened outside of Aave. Both Aave V3 and V4 does not have further exposure to rsETH. https://t.co/vt8j1BOUjB
