What to Know
- $292 million in rsETH drained from Kelp DAO’s bridge, covering 116,500 rsETH or roughly 18% of circulating supply
- Over $6.2 billion exited Aave within 36 hours as SparkLend, Fluid, Lido earnETH, and Ethena bridges paused
- Attackers exploited a 1-of-1 verifier setup on LayerZero, a single point of failure inside a product sold as decentralized
- Analysts compare stacked rsETH yield layers to 2008 mortgage products that hid, rather than removed, risk
The Kelp DAO exploit did not just empty a bridge. It cracked open the quiet truth about liquid restaking. On April 20, 2026, attackers drained roughly $292 million in rsETH from Kelp DAO, making off with 116,500 rsETH. That is about 18% of circulating supply. Within hours, Aave froze its rsETH markets, SparkLend and Fluid paused similar pools, Lido halted earnETH, and Ethena shut down its LayerZero bridges as a precaution. The cascade did not care which protocol you were using. It only cared what the collateral was stacked on.
How the Kelp DAO Exploit Unfolded in 36 Hours
The short version: one bridge broke, and the rest of DeFi started running for the door. According to on-chain forensics from the Kelp DAO exploit investigation, attackers drained 116,500 rsETH worth $292 million through a compromised cross-chain verification setup. The bridge in question was not some obscure side product. It was the piece of plumbing that let rsETH travel between Ethereum and the chains where its biggest lending markets lived.
Once the drain was confirmed, the reaction was brutal and fast. Aave governance moved to freeze rsETH markets across its deployments, and forum posts from the Aave rsETH incident thread show votes landing inside a single afternoon. More than $6.2 billion left Aave in under 36 hours, and that figure covers users who had no direct rsETH position. They just did not want to find out what else might be wired into the same collateral.
Stacking asset layers does not remove risk. It compresses and hides it.
Why Is This Being Compared to the 2008 Financial Crisis?
Because the collateral was wrapped in too many layers. Users staked ETH through Lido for stETH. That stETH was restaked in Kelp DAO and EigenLayer to mint rsETH. The rsETH was posted as collateral on Aave, SparkLend, and Fluid, then bridged through LayerZero into wrapped copies on other chains.
Each step looked sensible on its own. Put them in a stack and you get one base asset repackaged four deep, with every floor leaning on the floor below. That is the mortgage-backed security pattern of 2008, translated into smart contracts. Loss at the base does not stay at the base. It compounds upward.
- Layer 1: ETH staked with Lido, minting stETH
- Layer 2: stETH restaked through Kelp DAO and EigenLayer, minting rsETH
- Layer 3: rsETH pledged as collateral on Aave, SparkLend, and Fluid
- Layer 4: rsETH bridged via LayerZero into wrapped copies on other chains
The Bridge Design That Made One Node a Single Point of Failure
Here is the part that should make every restaking user uncomfortable. The bridge used a 1-of-1 verifier configuration. One node, one signature, one decision. If that node was compromised or its infrastructure poisoned, the attacker could forge cross-chain messages and mint rsETH that had nothing behind it.
The post-mortem from the rsETH exploit timeline describes exactly that: a poisoned RPC endpoint feeding the lone verifier, which then rubber-stamped withdrawal instructions that should never have cleared. The product page sold decentralization. The config file sold a single point of failure. Those two things do not belong in the same sentence.
No participant, including protocols themselves, can fully map their exposure network.
How DeFi Contagion Spread Beyond Kelp DAO
This is where the 2008 echo got loud. SparkLend and Fluid paused rsETH markets inside the same window Aave moved. Lido paused earnETH, which held rsETH exposure, even though core stETH was never touched. Ethena paused its LayerZero OFT bridges with no direct rsETH exposure at all, purely because it could not rule out indirect linkage in time.
Coverage of the DeFi contagion documented how quickly the freeze chain extended past the original protocol. The problem was not the exploit size on its own. $292 million is large, but DeFi has survived larger. The problem was nobody could map their exposure in real time. When you cannot verify what you own, you withdraw first and ask later.
That reflex is what turned a bridge failure into a balance-sheet event across half a dozen blue-chip protocols. The $6.2 billion Aave outflow tells you users voted with their wallets before any governance vote closed.
- Aave: rsETH markets frozen across deployments, $6.2B outflow in 36 hours
- SparkLend: rsETH markets paused the same day
- Fluid: rsETH markets paused, isolated mode invoked
- Lido earnETH: paused over rsETH exposure, core stETH unaffected
- Ethena: LayerZero OFT bridges paused as a precaution
What the Kelp DAO Exploit Means for Yield Stacking
Call it the end of innocent APY. The Kelp DAO exploit did not just embarrass one protocol. It put a price tag on the whole habit of reading yield numbers in isolation. Each restaking layer introduces validator slashing, restaking penalties, bridge bugs, smart-contract failures, and lending liquidations. The APY on the final product is the sum of every risk below it, compressed into a single number that looks like passive income.
The uncomfortable lesson for retail users is simple: a 9% restaking yield does not mean 9% of free money. It means the market is paying you to absorb risks you cannot see and, based on this week, risks the protocols themselves cannot fully see either. That is not a product flaw. It is the architecture working exactly as designed.
The question now is not whether restaking survives. It will. The question is whether protocols finally publish exposure maps that users can read before the next bridge breaks, or whether the industry keeps pricing opacity as a feature. On current evidence, the answer is not comforting.
What Happens Next for rsETH Holders and Restaking Markets?
Short term, expect tighter caps, stricter collateral factors, and a hard look at every 1-of-N verifier config still running in production. Aave’s governance thread is already pushing for multi-verifier requirements before rsETH markets reopen, and SparkLend’s risk team has signaled the same direction.
Longer term, the exploit sets a precedent. Any restaking token that bridges across chains will now carry a risk premium that reflects its weakest verifier, not its marketing copy. That is healthy. Painful, but healthy. The protocols that survive the next 90 days will be the ones that treat bridge security the way exchanges treat custody: as the product, not the plumbing.
Frequently Asked Questions
What is the Kelp DAO exploit?
The Kelp DAO exploit was an April 20, 2026 attack that drained roughly $292 million in rsETH, or 116,500 tokens equal to 18% of circulating supply, through a compromised 1-of-1 cross-chain verifier on LayerZero. The bridge was the weak point, not the core restaking contracts.
Why did Aave freeze rsETH markets?
Aave governance froze rsETH markets within hours of the Kelp DAO exploit to stop attackers from using unbacked rsETH as collateral to borrow other assets. The freeze lasted several hours. Over $6.2 billion still exited Aave within 36 hours as users cut indirect exposure across pools.
How is this comparable to the 2008 financial crisis?
Analysts compare it to 2008 because rsETH sat on top of stETH, which sat on top of staked ETH, which was then bridged and relent. That stacking mirrors mortgage-backed securities: one base asset repackaged through layers, each depending on the last. A failure at the base cascades upward fast.
Is rsETH safe to hold after the exploit?
The underlying rsETH contract on Ethereum was not compromised, but bridged versions and lending market exposure remain under review. Holders should check whether their rsETH sits on its native chain or a bridged wrapper, confirm collateral factors on Aave, SparkLend, and Fluid, and watch the Kelp DAO post-mortem closely.
This article is for informational purposes only and does not constitute investment advice. Every investment and trading decision involves risk. Readers should conduct their own research before making any financial decisions.
