An attacker drained 116,500 rsETH from KelpDAO’s cross-chain bridge on Saturday, marking one of the largest exploits of the year. The protocol halted further losses within an hour, but the incident is already rippling across DeFi.
• Exploit details: The attacker triggered a LayerZero EndpointV2 call that released 116,500 rsETH, worth about $292M, to an attacker-controlled wallet funded via Tornado Cash.
• Bridge vector: The exploit appears tied to Kelp’s LayerZero OFT bridge, which enables rsETH transfers across a number of networks.
• Aave exposure: Aave froze rsETH markets on V3 and V4 and is assessing potential bad debt, stating it may need to explore ways to cover any deficit. The stolen amount represents roughly 18% of rsETH supply; AAVE token fell about 10% following the incident.