A major DeFi attack hit Kelp DAO's cross-chain rsETH bridge, draining about 116,500 rsETH, roughly $292 million, representing around 18% of rsETH’s circulating supply.

The thief manipulated Kelp’s rsETH adapter bridge via a call to LayerZero’s lzReceive function, moving out the stolen funds and converting about $250 million into Ether through a Tornado Cash–funded address.

Security teams linked the initial data trails to Tornado Cash’s 1-ETH pool and observed obfuscation techniques as the attacker moved funds across chains.

Analysts warn the incident underscores DeFi composability risks and note ongoing investigations as Kelp seeks a response.

Markets reacted with a sharp drop in AAVE’s token price and heightened scrutiny of rsETH positions on Aave, Compound, and other lending platforms.

Questions arise about non-Ethereum deployments backing rsETH, with potential panic redemptions on Layer 2s and broader systemic risk to restaking positions.

Two follow-up attempts to drain funds at 18:26 and 18:28 UTC were thwarted when protections paused the exploit.

responses included pausing rsETH contracts on mainnet and several Layer 2s, and coordination with LayerZero, auditors, Unichain, and external security experts to investigate cross-chain activity.

Kelp DAO had not publicly confirmed the exploit at the time, while communities and platforms closely tracked potential fallout across DeFi lending markets.

Aave froze rsETH markets on both its V3 and V4 deployments, and at least nine protocols exposed to rsETH halted activity as a precaution against potential bad debt.

Aave said it would review rsETH borrows after the exploit and noted Umbrella assets could offset any resulting bad debt.

The incident is distinct from the Drift Protocol hack earlier in 2026, though both highlight DeFi risk from liquid restaking tokens.