$292M rsETH exploit exposes cross-chain dangers, forcing Kelp shutdown and Aave market freeze amid unhealthy debt issues.
A significant safety breach has struck Kelp DAO, leaving the protocol reeling after a large-scale cross-chain exploit. Early on Saturday, an attacker drained a good portion of its rsETH provide by way of a suspected LayerZero vulnerability. On-chain knowledge factors to a rigorously ready operation involving obfuscation instruments and focused contract calls. Market reactions adopted rapidly, with ripple results throughout associated DeFi platforms.
Kelp DAO Freezes Protocol After $292M Cross-Chain Exploit Try
Attackers siphoned roughly 116,500 rsETH, valued close to $292 million at present costs. Blockchain data present the drain occurred at 17:35 UTC by way of a name to the “lzReceive” perform on LayerZero’s EndpointV2 contract. That decision triggered Kelp’s bridge system to launch funds on to an attacker-controlled tackle.
Funding for the exploit dates again about 10 hours. The attacker used Twister Money’s 1-ETH pool, a technique typically related to transaction obfuscation. Shortly after the breach, blockchain investigator ZachXBT flagged the incident, estimating losses above $280 million throughout Ethereum and Arbitrum.
Kelp DAO responded inside an hour, throughout which its emergency multisig executed a “pauseAll” perform throughout key contracts. Techniques affected included the LRT Deposit Pool, withdrawal module, oracle, and the rsETH token itself. That transfer stopped additional injury and prevented further withdrawals.
Two follow-up makes an attempt by the attacker failed. Transactions at 18:26 and 18:28 UTC tried to empty one other 40,000 rsETH, value about $100 million. Each had been rejected because of the protocol’s paused state. With out that intervention, complete losses may have climbed close to $391 million.
Earlier in the present day we recognized suspicious cross-chain exercise involving rsETH. We now have paused rsETH contracts throughout mainnet and a number of other L2s whereas we examine.
We’re working with @LayerZero_Core, @unichain, our auditors and prime safety specialists on RCA.
We are going to maintain you…
— Kelp (@KelpDAO) April 18, 2026
Kelp later confirmed “suspicious cross-chain exercise” in a public assertion posted at 20:10 UTC. The workforce mentioned it paused contracts throughout the mainnet and a number of Layer 2 networks whereas investigating. Collaboration is underway with LayerZero, Unichain, auditors, and exterior safety specialists.
Aave Freezes rsETH Markets After Kelp Bridge Exploit Sparks Unhealthy Debt Fears
Focus has turned to Kelp’s Omnichain Fungible Token bridge. That system permits rsETH transfers throughout networks and seems central to the exploit path. The stolen quantity represents roughly 18% of rsETH’s circulating provide, estimated at 630,000 tokens. The asset operates throughout greater than 20 networks, together with Arbitrum, Base, and Scroll.
Shockwaves unfold to different protocols, particularly lending markets. AAVE dropped about 10% following reviews that the platform could face publicity to unhealthy debt linked to rsETH positions. In response, Aave froze rsETH markets on each V3 and V4 deployments.
The rsETH markets on Aave V3 and Aave V4 have been frozen. Aave’s contracts haven’t been exploited and that is an exploit associated to rsETH.
The freeze follows an exploit of the Kelp DAO rsETH bridge. Freezing the rsETH markets prevents new deposits and borrowing in opposition to rsETH…
— Aave (@aave) April 18, 2026
Aave clarified that its sensible contracts weren’t compromised. As an alternative, the problem stems from rsETH itself. The workforce is now reviewing the borrow exercise tied to the exploit. Preliminary statements referenced potential use of the Umbrella security module, although later updates softened that stance. Aave now says it’s going to assessment choices if losses materialize.
Repeat Incident Raises Alarm Over Kelp DAO’s Safety and Cross-Chain Dangers
Saturday’s incident marks Kelp DAO’s second main disruption inside a yr. Again in April 2025, a bug in its charge contract triggered extra rsETH minting. That occasion led to a short lived pause however didn’t lead to consumer fund losses.
Present situations have rsETH buying and selling close to $2,500, reflecting uncertainty in regards to the protocol’s stability. Kelp DAO and co-founder Amitej Gajjala have but to offer additional particulars past preliminary statements.
Consideration now shifts to root trigger evaluation and potential restoration paths. The size of the exploit raises broader issues round cross-chain bridge safety. As investigations proceed, each customers and protocols linked to rsETH face heightened threat and ongoing uncertainty.