Kelp’s Big Mistake: $293M Gone, DeFi in Chaos!

by

Kelp, the “liquid restaking” platform, found itself in a sticky situation when a cyber attack hit on Saturday, leaving rsETH tokens in a state of panic. Who knew a few lines of code could cause such a ruckus?

  • Kelp’s exploit targeted the rsETH bridge contract, resulting in a $293 million heist in record time-probably while the team was on lunch break.
  • Stolen funds zipped through Tornado Cash, with a hefty chunk turned into Ether across networks-because who needs privacy when you’re a crypto villain?
  • DeFi platforms panicked, freezing rsETH activity as the contagion risk spread across nine protocols-probably because they didn’t want to lose their own money.

The team, upon spotting unusual cross-chain activity, swiftly paused smart contracts across the main network and several Layer-2 systems. “We’re investigating,” they said, while probably sipping coffee and watching the money disappear.

Meanwhile, the exploit focused on the rsETH adapter bridge contract. This component manages token transfers across chains-like a crypto version of a poorly secured mailbox.

Cyvers, the blockchain security firm, estimated losses at a cool $293 million-because nothing says “we’re serious” like a round number. The attacker gained access to funds by targeting this contract, leading to a large outflow within a short time. Maybe they just needed a little extra liquidity?

Stolen Funds Moved Through Crypto Channels

Cyvers reported that the attacker used an address funded via Tornado Cash, the go-to tool for those who want to hide their tracks-like a magician’s hat. A large portion of the stolen funds, about $250 million, has already been converted into Ether. Because why keep it in a risky token when you can just turn it into the universal crypto currency?

The movement of funds has raised concerns among platforms connected to rsETH. Monitoring teams continue to track the assets as they move across networks. No recovery of funds has been confirmed so far. Kelp has not released further technical details about the breach at this stage-probably because they’re still trying to figure out how the attacker got in.

Moreover, the attack caused what Cyvers described as “cross-protocol contagion.” At least nine crypto platforms had exposure to rsETH and took action to limit risk. Many of them paused or restricted activity involving the token-because nothing says “we’re safe” like a sudden freeze.

Aave, ever the responsible guardian, froze rsETH markets on its V3 and V4 platforms-because nothing says “we care” like a quick freeze. Cyvers CEO Deddy Lavid noted that the event “highlights the risks of composability in DeFi,” which is just a fancy way of saying “when everything is connected, everything can be hacked.”

Rising Security Concerns in Crypto Sector

The Kelp incident joins the growing list of crypto platform breaches, proving that even the most secure systems can be as vulnerable as a house of cards in a hurricane. Data shows that losses from hacks and scams reached about $482 million in the first quarter of 2026-because apparently, 2026 is the year of “I’ll just steal your money and run.”

Another recent case involved Drift Protocol, which lost about $280 million in an exploit. The platform reported that attackers spent months gaining access before deploying malware. These incidents show ongoing challenges in securing decentralized finance systems-unless “secure” means “we’ll get hacked, but maybe not today.”

Read More

2026-04-19 12:19