A cross-chain bridge containing nearly a fifth of the circulating supply of a reinvested ether token has just been exhausted, and the fallout is spreading across DeFi faster than Kelp DAO can suspend contracts.
An attacker drained 116,500 rsETH (restaked ether) from Kelp DAO’s LayerZero-powered bridge at 5:35 p.m. UTC on Saturday, worth approximately $292 million at current prices and representing approximately 18% of the 630,000 circulating tokens of rsETH tracked by CoinGecko.
LayerZero is a cross-chain messaging layer, or the infrastructure that allows different blockchains to send verified instructions to each other. Kelp DAO is a liquid takeover protocol, which takes user-deposited ETH, routes it through EigenLayer to earn additional yield on top of standard Ethereum staking rewards, and issues rsETH as a tradable receipt.
The bridge that was dumped contained the rsETH reserve wrapped versions of the token deployed on over 20 other blockchains.
The attacker tricked LayerZero’s cross-chain messaging layer into believing that a valid instruction had arrived from another network, prompting Kelp’s bridge to release 116,500 rsETH to an address controlled by the attacker.
Kelp’s multisig emergency pause froze the protocol’s core contracts 46 minutes after the successful drain, at 18:21 UTC. Two follow-up attempts at 18:26 UTC and 18:28 UTC were both canceled, each carrying the same LayerZero packet attempting another 40,000 rsETH drain worth around $100 million.
rsETH is deployed on over 20 networks, including Base, Arbitrum, Linea, Blast, Mantle and Scroll, with LayerZero’s OFT standard managing cross-chain movement.
The rsETH held in the bridge were the reserve media wrapped versions on each layer 2 blockchain, or the networks that operate on top of Ethereum.
With this reserve exhausted, holders of non-Ethereum deployments are now faced with the question of whether their tokens contain anything underneath, creating a feedback loop where panic buybacks on L2s put pressure on the unaffected Ethereum supply, potentially forcing Kelp to cancel its positions to honor the withdrawals.
The list of contagions is long and continues to grow.
Aave froze the rsETH markets on V3 and V4 within hours, with founder Stani Kulechov claiming the exploit was external and that Aave’s contracts were not compromised. SparkLend and Fluid have frozen their rsETH markets.
AAVE has fallen about 10% as the market prices potential bad loans.
Lido Finance has suspended additional deposits into its EarnETH product, which carries exposure to rsETH, while clarifying that stETH and wstETH are not affected and that Lido’s main staking protocol is not involved in the incident.
Ethena has temporarily suspended its LayerZero OFT bridges from the Ethereum mainnet as a precaution, saying it has no exposure to rsETH and remains oversized at over 101%. The stablecoin issuer said the pause would last around six hours while the root cause is identified.
Kelp, a product under the KernelDAO umbrella, acknowledged the incident in its first public X post at 8:10 p.m. UTC, nearly three hours after the dump. The protocol said it was investigating with LayerZero, Unichain, its auditors and external security specialists. He did not reveal how the exploit bypassed the bridge’s validation logic.
Keeping rsETH going through the weekend depends on how much of the cross-chain float is trying to be exchanged for ETH on Ethereum and whether Kelp can recover some of the stolen funds before the Tornado Cash trail goes cold.
The hack lands in an unusually hostile time for DeFi. Solana-based perpetual protocol Drift lost approximately $285 million on April 1 in an attack later linked to actors affiliated with North Korea, and at least a dozen smaller protocols were exploited in the weeks that followed, including CoW Swap, Zerion, Rhea Finance, and Silo Finance.
Kelp’s $292 million loss is now the biggest DeFi exploit of 2026, surpassing Drift by a few million dollars.
