A major security warning has been issued across DeFi protocols following a $292 million exploit of Kelp DAO's rsETH token, triggering an immediate 10% market correction. The breach, one of the largest DeFi shocks of 2026, has exposed critical vulnerabilities in cross-protocol lending and restaking markets, with market focus now shifting to which major protocols like AAVE will absorb the cascading damage.

What’s the story?

The suspected attack targeted the Kelp DAO cross-chain bridge for rsETH, a liquid restaking token. In simple terms, that token lets users keep a tradable receipt for staked ETH. On-chain tracking showed about 116,500 rsETH, worth roughly $292 million, moved out through LayerZero-related contract calls. Kelp DAO paused core contracts about 46 minutes later and said it blocked later attempts while investigating with LayerZero and Unichain.

Stani Kulechov said that the lost borrowing power after an exploit outside Aave. Its analysis showed that rsETH on Ethereum mainnet remains fully backed, though rsETH and some WETH reserves stay frozen across affected markets as a safeguard.

Source: Wu Blockchain X

How did this happen?

Early analysis points to a trust failure around the app’s message path, not a confirmed LayerZero-wide bug. Security commentary said the setup may have relied on a 1-of-1 DVN, or validator network, instead of a safer 2-of-2 default. That matters because a single compromised signer can become a single point of failure.

Reports tied the root cause to a leaked or stolen source-chain private key. Analysts said a trusted node marked as Kelp DAO may have issued a message that triggered one lzReceive call and released the 116,500 rsETH from custody. That explains why investigators are focusing on key security and node trust, not only bridge code.

Why AAVE Became the Center of the Crisis?

Aave became the pressure point, although it was not hacked. The damage came after the Kelp DAO bridge exploit on April 18, 2026. The attacker then used that as collateral on Aave to borrow large amounts of ETH. The token then froze the rsETH markets on V3, and V4 launches from 18:52 UTC. It also froze WETH reserves in affected markets, including Ethereum, Arbitrum, Base, Mantle, and Linea. Aave Token saw more than $5.4 billion in outflows.

Source: CoinMarketCap

The latest position on the Ethereum mainnet remains fully backed. Still, users rushed to pull funds. That drove utilization rates sharply higher and tightened DeFi liquidity. Now, Aave’s next challenge is to contain losses while protecting core depositors.

If the collateral cannot fully cover those borrows, Aave is left with bad debt. Multiple current reports put that exposure at roughly $177 million to $200 million. Yet the final realized loss that Aave DAO will ultimately absorb is not confirmed. 

Source:  Official X

Other Protocols Hit Due To Kelp DAO Exploit: Who got hit and why does it matter?

• Lido Earn suspended earnETH deposits due to rsETH exposure.

• Kamino switched some LayerZero-linked assets to withdrawal-and-repayment-only mode.

• Morpho paused its OFT bridge on Arbitrum.

• Upbit and Bithumb warned KernelDAO holders about volatility.

• Curve founder Michael Egorov used the event to warn about the risks of non-isolated lending pools. That debate now sits at the center of DeFi risk design. If losses stay concentrated on Layer 2 markets, those chains may face the hardest stress. If losses are shared more broadly, contagion risk may ease, though the political cost could rise.

What's next for rsETH and Aave?

The next step for Kelp DAO  is loss allocation. Ethereum mainnet rsETH is still backed, which may protect the core market. Even so, frozen markets, bridge pauses, and exchange warnings show how quickly a cross-chain failure can shake DeFi liquidity. That is why traders will watch remediation plans, insurance backstops, and governance decisions very closely.

Disclaimer: This article is for information only. It is not financial advice. Crypto markets carry high risk. Facts may change as on-chain reviews, governance votes, and official investigations continue.