A cross-chain bridge containing nearly a fifth of the circulating supply of a re-staked ether token just ran out, and the fallout is moving through DeFi faster than Kelp DAO can pause contracts.
An attacker drained 116,500 rsETH (repurchased ether) from Kelp DAO’s LayerZero-powered bridge at 17:35 UTC on Saturday, worth approximately $292 million at current prices and representing around 18% of the circulating supply of 630,000 rsETH tokens tracked by CoinGecko.
LayerZero is a cross-chain messaging layer, or the infrastructure that allows different blockchains to send verified instructions to each other. Kelp DAO is a liquid recovery protocol, which takes user-deposited ETH, routes it through EigenLayer for additional yield on top of standard Ethereum staking rewards, and issues rsETH as a tradable receipt.
The bridge that was drained contained the rsETH reserve that backed wrapped versions of the token deployed on more than 20 other blockchains.
The attacker tricked LayerZero’s cross-chain messaging layer into believing that a valid instruction had arrived from another network, causing the Kelp bridge to release 116,500 rsETH to an address controlled by the attacker.
Kelp’s multisig emergency pauser froze the protocol’s core contracts 46 minutes after the successful drain, at 18:21 UTC. Two follow-up attempts at 18:26 UTC and 18:28 UTC reverted, each with the same LayerZero packet attempting another drain of 40,000 rsETH worth approximately $100 million.
rsETH is deployed on more than 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, and LayerZero’s OFT standard handles cross-chain movement.
The rsETH held on the bridge was the reserve that backed the versions wrapped in each layer 2 blockchain, or networks running on top of Ethereum.
With that reserve depleted, holders of non-Ethereum implementations now face the question of whether their tokens have anything underneath them, creating a feedback loop where panic swaps on L2s put pressure on the supply of unaffected Ethereum, potentially forcing Kelp to unwind positions to recover positions to honor withdrawals.
The list of infections is long and continues to grow.
Aave froze the rsETH markets on V3 and V4 within hours, with founder Stani Kulechov claiming that the exploit was external and that Aave contracts were not compromised. SparkLend and Fluid froze their rsETH markets.
AAVE fell about 10% as the market priced in potential bad debts.
Lido Finance paused further deposits into its winETH product, which carries exposure to rsETH, while clarifying that stETH and wstETH are not affected and that Lido’s core staking protocol is not involved in the incident.
Ethena temporarily halted its OFT LayerZero bridges from the Ethereum mainnet as a precaution, saying it has no exposure to rsETH and remains overcollateralized by more than 101%. The stablecoin issuer said the pause would last approximately six hours while the root cause is identified.
Kelp, a product under the KernelDAO umbrella, acknowledged the incident in its first public post X at 20:10 UTC, almost three hours after the drain. The protocol said it was investigating with LayerZero, Unichain, its auditors and third-party security specialists. It has not revealed how the exploit bypassed the bridge’s validation logic.
Whether rsETH remains pegged over the weekend depends on how much cross-chain float it attempts to redeem for ETH on Ethereum and whether Kelp can recover any of the stolen funds before Tornado Cash’s trail goes cold.
The hack lands on an unusually hostile streak for DeFi. Solana-based perpetual protocol Drift lost around $285 million on April 1 in an attack later linked to North Korean-affiliated actors, and at least a dozen smaller protocols have been exploited in the weeks since, including CoW Swap, Zerion, Rhea Finance, and Silo Finance.
Kelp’s $292 million loss is now the biggest DeFi exploit of 2026, surpassing Drift by a few million dollars.
