Back Tipranks

Major rsETH Exploit Highlights Ongoing DeFi Bridge and Counterparty Risks

Tipranks • April 19, 2026

According to a recent post from The Block , an attacker appears to have drained 116,500 rsETH from Kelp DAO’s LayerZero-powered cross-chain bridge on Saturday, with an indicated value of $292 million at current market prices. The post notes that Kelp’s emergency pauser multisig froze core protocol contracts roughly 46 minutes after the drain, reportedly blocking two subsequent attempts.

The Block’s coverage indicates that Kelp DAO acknowledged the incident and is investigating it alongside LayerZero and Unichain, suggesting an active incident-response and forensic phase. Aave is described as having frozen rsETH markets on its V3 and V4 deployments and as planning to “explore paths to offset the deficit” from any bad debt, moves that may limit immediate contagion but highlight counterparty and smart-contract risk across DeFi platforms.

For investors following the broader decentralized finance ecosystem rather than these private entities specifically, the episode underscores ongoing security vulnerabilities in cross-chain bridge infrastructure and liquid staking assets such as rsETH. The post also implies that leading protocols may prioritize rapid risk containment and potential loss socialization or remediation, factors that could influence user confidence, liquidity flows, and ultimately valuations across the sector over time.

Disclaimer & Disclosure Report an Issue

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kelp DAO Exploit: $293 Million Drain Triggers DeFi Contagion On April 18, 2026, Kelp DAO's LayerZero-powered cross-chain bridge was exploited, resulting in the theft of 116,500 rsETH, valued at approximately $293 million. The attacker utilized a forged cross-chain message to trick the bridge into releasing the funds to an attacker-controlled address. This exploit represents about 18% of rsETH's circulating supply and has caused significant disruption across the DeFi ecosystem, impacting at least nine other platforms, including Aave, which froze its rsETH markets to prevent further losses. The stolen funds were quickly converted into ETH, raising concerns about the backing of rsETH on various networks. Kelp DAO has paused its contracts while investigating the incident and coordinating with security experts. The attack highlights vulnerabilities in cross-chain bridge infrastructure and the interconnectedness of DeFi protocols. 187 sources 66

Extracted Entities

Major rsETH Exploit Highlights Ongoing DeFi Bridge and Counterparty Risks

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Platforms (2)