Luisa Crawford
Apr 19, 2026 17:45
Kelp liquid restaking hack cascaded by way of Aave, Compound, and seven different DeFi platforms. rsETH down 23% as business debates remoted lending dangers.
A $293 million exploit of liquid restaking protocol Kelp DAO has rippled throughout the DeFi ecosystem, forcing at the very least 9 main platforms to freeze markets or scramble harm management measures in what safety researchers are calling a “cross-protocol contagion occasion.”
The assault, which focused Kelp’s rsETH adapter bridge contract on Saturday, did not keep contained. Aave, Compound Finance, Fluid, SparkLend, and Euler all took emergency motion to freeze rsETH markets because the exploit’s shockwaves unfold by way of interconnected lending swimming pools.
rsETH has cratered 23% prior to now 24 hours, buying and selling at $1,962 with a market cap of $1.23 billion as of Sunday afternoon.
The Cross-Chain Downside
Curve Finance founder Michael Egorov pointed to non-isolated lending because the core vulnerability that allowed localized harm to grow to be systemic. Earlier variations of Aave and related protocols expose customers to dangers from each token accepted as collateral—when one fails, everybody holding positions in that pool will get harm.
“Cross-chain is difficult and doubtlessly dangerous. Solely use cross-chain infrastructure when completely essential, and do it actually fastidiously,” Egorov mentioned, noting that Kelp’s bridge structure was the assault’s entry level.
His recommendation for DeFi groups: vet tokens for single factors of failure earlier than approving them as collateral. Simpler mentioned than carried out when yield-hungry protocols race to combine the most recent restaking derivatives.
A Sample Rising
This wasn’t an remoted incident. The Kelp exploit follows final week’s $280 million Drift Protocol hack and at the very least 12 different crypto platform assaults earlier this month. Q1 2026 losses from hacks, exploits, and scams already hit $482 million earlier than this weekend’s occasions.
Blockchain safety agency Cyvers mapped how the stolen funds moved by way of Twister Money and transformed to ETH throughout a number of networks—a now-familiar laundering playbook.
“The problem is not simply stopping exploits on the contract stage, however understanding how briskly they will cascade throughout built-in protocols,” Cyvers CEO Deddy Lavid informed Cointelegraph.
What Occurs Subsequent
Kelp has paused all rsETH sensible contracts whereas investigating. The protocol, based by the workforce behind Stader Labs, constructed its enterprise on simplifying restaking by letting customers deposit liquid staking tokens and obtain rsETH—a token that might then be used throughout DeFi for extra yield.
That composability, which made Kelp enticing, additionally made it harmful. When rsETH grew to become nugatory collateral in a single day, each protocol that accepted it confronted the identical drawback concurrently.
For merchants with publicity to any of the 9 affected platforms, the speedy precedence is checking place well being and monitoring bulletins from protocol governance. The broader query—whether or not DeFi’s interconnected structure creates unacceptable systemic threat—will not be answered this week. However it’s getting more durable to disregard.
Picture supply: Shutterstock
