Kelp DAO’s $292M Fiasco: When Bridges Become Sinking Ships

by

In a spectacle as predictable as a Waugh novel, Wu Blockchain reports that Kelp DAO has fallen victim to a cross-chain exploit of such audacity that one might suspect the gods of finance have taken a perverse delight in the affair. Some 116,500 rsETH, valued at a staggering $292 million, have vanished into the ether-or rather, into the pockets of a cunning miscreant. This debacle arrives with the punctuality of a London fog, less than a year after a previous fracas involving a smart contract bug, leaving one to wonder if Kelp DAO’s security protocols are as flimsy as a debutante’s resolve at a society ball.

Kelp DAO’s Gallant Effort: A Case of Locking the Stable After the Horse Has Bolted

According to the ever-vigilant blockchain data, the exploit targeted a weakness in cross-chain communication-specifically, the bridge mechanism, that modern-day Trojan Horse of DeFi. The attacker, with a flourish worthy of a Dickensian villain, invoked the “Iz Receive” function on LayerZero’s EndpointV2, thereby triggering the release of funds to a wallet as anonymous as a masked ball attendee. The swiftness of the heist was matched only by the ineptitude of its prevention.

On-chain sleuth ZachXBT, a man whose nose for trouble rivals that of a hound on the scent, was among the first to uncover the breach. He estimates losses exceeding $280 million across Ethereum and Arbitrum, noting with a touch of irony that the attack addresses were funded via Tornado Cash-a gesture as subtle as a brick through a window.

Earlier today we identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate.

We are working with @LayerZero_Core, @unichain, our auditors, and top security experts on RCA.

We will keep you…

– Kelp (@KelpDAO) April 18, 2026

In a move as belated as a wedding guest’s apology, Kelp DAO halted all rsETH contracts across its mainnet and connected L2 networks. The protocol also froze activity across its core contracts, a gesture as effective as shutting the gates after the barbarians have already dined. An investigation, involving LayerZero and Unichain, is said to be underway-though one suspects it will yield as much clarity as a foggy morning in the English countryside.

The attacker, not content with a single stroke of genius, attempted two additional transactions to drain another 40,000 rsETH, worth nearly $100 million. Fortunately, Kelp DAO’s swift measures ensured these attempts failed, preventing the losses from ascending to the dizzying heights of $391 million. A narrow escape, indeed, though one wonders if the horse has merely been replaced by a slightly slower one.

Aave Freezes rsETH Contracts: A Precaution as Obvious as a Nose on a Face

The fallout, as inevitable as a hangover after a night of excess, has spread beyond Kelp DAO. Aave, that titan of DeFi lending, responded by freezing rsETH markets across its V3 and V4 deployments. A move as precautionary as locking one’s jewels in a safe after the thief has already departed.

Aave, with a dignity befitting its stature, clarified that its own smart contracts were not exploited. The freeze, they assure us, is merely to limit further debt exposure to rsETH as they assess the situation. A gesture as reassuring as a bandage on a gaping wound.

The rsETH markets on Aave V3 and Aave V4 have been frozen. Aave’s contracts have not been exploited and this is an exploit related to rsETH.

The freeze follows an exploit of the Kelp DAO rsETH bridge. Freezing the rsETH markets prevents new deposits and borrowing against rsETH…

– Aave (@aave) April 18, 2026

rsETH, that liquid restaking token designed to represent staked ETH while enabling users to earn additional yield through restaking strategies, plays a key role in cross-chain DeFi. It allows capital to move seamlessly across networks, a convenience as dangerous as leaving one’s door unlocked in a den of thieves. The scale of the exploit is particularly damaging, as the stolen funds represent roughly 18% of rsETH’s total circulating supply-a significant hit to both liquidity and user confidence, though one suspects the latter was already as fragile as a china teacup.

rsETH Exploit Impact Chart

Read More

2026-04-19 17:56