Gate News message, April 19 — On April 18 at 17:35 UTC, an attacker exploited a vulnerability in Kelp DAO’s LayerZero-powered cross-chain bridge, releasing 116,500 rsETH (approximately $293 million and roughly 18% of the token’s circulating supply) to an attacker-controlled wallet without corresponding ETH being locked. The attacker then deposited the unbacked rsETH into Aave V3 and V4 as collateral, borrowing real wrapped ether (WETH) against it. By the time Kelp’s emergency multisig froze the protocol 46 minutes later, the WETH had been withdrawn.
The bridge vulnerability allowed the attacker to submit a crafted message that passed verification checks despite no actual deposit on the source chain. Two follow-up attempts at 18:26 and 18:28 UTC to drain an additional 40,000 rsETH each were reverted after the pause was activated.
Aave now carries between $177 million and $236 million in bad debt, concentrated in the rsETH/WETH pair on Ethereum. The platform’s total value locked (TVL) dropped approximately $6 billion, WETH market utilization hit 100% (preventing further withdrawals), and AAVE token declined over 18%. Aave’s Umbrella insurance fund holds about $50 million, leaving a significant gap. The borrow positions are effectively unliquidatable as rsETH collateral cannot be redeemed and will not trade near peg once the unbacked supply is fully recognized.
SparkLend, Fluid, and Upshift paused or froze rsETH within hours; Morpho’s isolated market architecture limited exposure to approximately $1 million across two markets. rsETH across 20-plus chains now faces backing uncertainty until Kelp publishes a reconciliation of reserves against outstanding supply. This exploit marks the largest DeFi incident of 2026, with cumulative DeFi losses for the year reaching between $450 million and $482 million across roughly 45 protocols.
Disclaimer: The information on this page may come from third parties and does not represent the views or opinions of Gate. The content displayed on this page is for reference only and does not constitute any financial, investment, or legal advice. Gate does not guarantee the accuracy or completeness of the information and shall not be liable for any losses arising from the use of this information. Virtual asset investments carry high risks and are subject to significant price volatility. You may lose all of your invested principal. Please fully understand the relevant risks and make prudent decisions based on your own financial situation and risk tolerance. For details, please refer to
Disclaimer.
Related Articles
Expert Claims Altcoin Metrics Are Being 'Gamed' to Mislead Investors
Crypto researcher Orbion raises concerns over the possible manipulation of key market indicators, including the Altseason Index and Crypto Fear and Greed Index, suggesting that inflated metrics create false optimism and mislead investors about the onset of altcoin season.
Coinpedia4h ago
Curve Finance Suspends LayerZero Infrastructure Following rsETH Hack
Curve Finance has temporarily suspended its LayerZero infrastructure due to a security incident involving rsETH. The protocol is investigating the issue, affecting certain cross-chain bridging operations while others continue as normal.
GateNews6h ago
KelpDAO Exploiter Borrows $195M ETH from Aave, TVL Drops $6.28B as Whales Withdraw
Gate News message, the KelpDAO exploiter borrowed over 82,600 ETH ($195M) from Aave using RSETH as collateral, resulting in bad debt appearing on Aave. Following this incident, numerous whales withdrew funds from Aave, causing its TVL to decline from $26.396B to $20.114B, a decrease of $6.28B.
GateNews8h ago
Monad Co-Founder Suggests Dynamic Caps on Collateral Deposits to Mitigate Hacking Risks
Keone Hon suggests that pooled lending protocols should implement gradual rate limits on collateral asset increases to mitigate risks during hacks. He argues this could have prevented significant losses, as seen with rsETH depositors.
GateNews12h ago
Hong Kong Police Warn of 'AI Quantitative Trading' Crypto Scam, Woman Loses HK$7.7 Million
Hong Kong police revealed a cryptocurrency fraud where a woman lost HK$7.7 million to scammers posing as investment experts via Telegram, promising high returns through AI trading. The police warned the public of the risks associated with cryptocurrency investments.
GateNews12h ago
Morpho Pauses MORPHO OFT Cross-Chain Bridge on Arbitrum Following Kelp DAO and LayerZero Events
Morpho Association has temporarily suspended the OFT cross-chain bridge for MORPHO tokens on Arbitrum due to recent issues with Kelp DAO and LayerZero Bridge, pending confirmation of the rsETH incident's cause.
GateNews13h ago
