Kelp DAO bridge exploit nets attacker $291M in rsETH, triggers $6.2B Aave withdrawal run
decrypt.co â˘
Revision history
2 recorded changes
Want your article here?
Promote with Leviathan NewsAn attacker exploited Kelp DAO's LayerZero-powered bridge with a phantom message, minting $291M in rsETH on Ethereum without burning the corresponding tokens on Unichain. The stolen collateral was looped through Aave to borrow real assets, pushing WETH pools to 100% utilization, freezing user withdrawals, and triggering $6.2B in net Aave outflows by Sunday morning. Aave froze rsETH markets while Kelp paused contracts across mainnet and several L2s. AAVE dropped 16% to $90.13 and ETH slid 2% to $2,300 on the news.
TLDR by @Benthic
More coverage
- The KelpDAO rsETH Exploit: $292M Minted From a 1-of-1 Bridge (defiprime.com)
- KelpDAO rsETH $292M Bridge Exploit (Explained) - QuillAudits (quillaudits.com)
- Inside the KelpDAO Bridge Exploit - Chainalysis (chainalysis.com)
- KelpDAO/LayerZero Exploit Drains $290m, Freezes DeFi Markets (galaxy.com)
- Kelp DAO's rsETH bridge apparently exploited for roughly $292 ... (x.com)
Explore the topic
More on Exploit
Symbiosis recovers 15 BTC after a Bitcoin Bridge exploit, worth $1.15M, while offering the attacker a 20% white-hat bounty for returning funds
The Block ¡
Citadel urges SEC to oversee event contracts tied to public companies, warning venues could exploit CFTC self-certification to bypass SEC jurisdiction
The Block ¡
CoinGeckoâs 2026 Crypto Security Report finds $3.63B stolen across 245 incidents, with supply-chain attacks, smart contract exploits and key compromises leading losses
đ/@bobbyong ¡
SlowMist warns of a new BNB Chain attack mirroring Notional Financeâs $1.7M exploit, with malicious fCash positions awaiting maturity before funds can be pulled
đ/@TheBlockCo ¡
OpenAI says its new Astra AI can autonomously find zero-day vulnerabilities and build working exploits, marking the companyâs first âCriticalâ cyber capability rating
Coindesk ¡
Attacker exploits binary-options settlement bug on Injective, bridges $4.9M to Ethereum; funds remain untouched.
ę/@defimon_alerts ¡
Symbiosis recovers 15 BTC after a Bitcoin Bridge exploit, worth $1.15M, while offering the attacker a 20% white-hat bounty for returning funds
The Block ¡
Citadel urges SEC to oversee event contracts tied to public companies, warning venues could exploit CFTC self-certification to bypass SEC jurisdiction
The Block ¡
CoinGeckoâs 2026 Crypto Security Report finds $3.63B stolen across 245 incidents, with supply-chain attacks, smart contract exploits and key compromises leading losses
đ/@bobbyong ¡
SlowMist warns of a new BNB Chain attack mirroring Notional Financeâs $1.7M exploit, with malicious fCash positions awaiting maturity before funds can be pulled
đ/@TheBlockCo ¡
OpenAI says its new Astra AI can autonomously find zero-day vulnerabilities and build working exploits, marking the companyâs first âCriticalâ cyber capability rating
Coindesk ¡
Attacker exploits binary-options settlement bug on Injective, bridges $4.9M to Ethereum; funds remain untouched.
ę/@defimon_alerts ¡