Kelp DAO’s $292M rsETH exploit triggers DeFi market panic
6.6 Security Kelp DAO’s rsETH token was exploited for up to $292M, impacting Aave and other DeFi protocols. The attack caused major bad debt, emergency pauses, and market uncertainty, marking 2026’s largest DeFi hack.
Kelp DAO’s rsETH liquid restaking token suffered a major exploit, with attackers draining approximately 116,500 rsETH—valued between $280 million and $292 million—via a vulnerability in the LayerZero-powered cross-chain bridge. The attacker funded wallets through Tornado Cash before executing the exploit, which released a significant portion of rsETH’s circulating supply. The stolen tokens were used as collateral on Aave V3, resulting in unrecoverable WETH obligations and substantial bad debt for the protocol. Emergency pauses were enacted across Kelp DAO and affected DeFi protocols, including Aave, SparkLend, and Fluid, to contain the fallout. This exploit, now the largest DeFi hack of 2026, has raised doubts about rsETH’s backing across networks and pressured its peg, challenging Kelp DAO’s ability to meet redemptions. The incident triggered a sharp drop in AAVE token value, a pause in Ethereum price bets, and heightened market caution as traders reassess DeFi risk and network security.
