Kelp DAO is facing a major security crisis after an apparent exploit on its rsETH cross-chain bridge drained about 116,500 rsETH, worth roughly $292 million at the time of the attack. Based on reporting and onchain data, the attacker appears to have used LayerZero messaging to trigger a release of funds from Kelp DAO’s bridge system. The incident quickly spread across crypto markets because rsETH is widely used in DeFi, especially as collateral in lending platforms.
The case matters because rsETH is a liquid restaking token. That means users deposit assets tied to Ethereum staking and receive a token they can move, trade, or use in DeFi while still keeping staking exposure. Kelp DAO built rsETH to work across many blockchains, and that is where the risk grew. LayerZero’s OFT, or Omnichain Fungible Token, standard is designed to move one token across many chains while keeping one shared supply. That makes cross-chain use easier, but it also means bridge security becomes central to the token’s safety.
Reports say the first successful drain happened at 17:35 UTC. Kelp DAO then used its emergency pauser multisig about 46 minutes later to freeze core contracts. That pause appears to have blocked two later attempts to drain another 40,000 rsETH. Kelp said it had identified suspicious cross-chain activity and was working with LayerZero, Unichain, auditors, and outside security experts to investigate the root cause. In plain terms, the attack seems to have hit the bridge logic that lets rsETH move between networks, not a normal wallet or simple front-end bug.
The attack also raised concern because the wallet tied to the exploit was reportedly funded through Tornado Cash before the incident. In DeFi exploits, that often signals an attempt to hide the money trail. Blockchain investigator ZachXBT flagged the attack soon after it happened, and market watchers began to focus on how much of rsETH’s supply had been affected. Reports said the stolen amount was about 18% of circulating rsETH, which is large enough to create stress across lending markets, price feeds, and risk systems.
That is why Aave moved fast. Aave froze rsETH markets on V3 and V4 and said its own smart contracts were not the source of the exploit. The bigger issue for Aave is bad debt. In lending, bad debt can appear when collateral loses value or cannot be liquidated in time. Aave’s own docs note that bridge and network risk can feed into this problem. Its Umbrella system was built as an automated onchain risk tool meant to help cover deficits, though Aave later softened its public wording and said it would explore ways to offset any deficit from this event.
This is also not the first rsETH problem. Kelp DAO had another incident in April 2025, when it paused deposits and withdrawals after a fee contract bug caused excess rsETH minting. Kelp said no user funds were lost in that earlier case, but the new exploit is far more serious because it appears to involve direct loss of funds at scale. That history matters. In crypto, one incident can be treated as a mistake. Two incidents in about a year raise harder questions about design, testing, and operational controls.
The bigger lesson from the Kelp DAO exploit is that DeFi risk does not stop at one protocol. A bridge attack can hit a token, then spread into lending markets, then affect users who never touched the bridge at all. That is the hidden cost of composability. Systems like Kelp DAO, LayerZero, and Aave are built to connect crypto markets, but strong connections also carry stress faster when something breaks. For users, the Kelp DAO exploit is a reminder that liquid restaking, cross-chain tokens, and DeFi yield can offer flexibility, but they also add layers of smart contract risk, bridge risk, and collateral risk that can all fail at once.
