Kelp hack: Impact on Aave and systemic risks for DeFi

How Kelp was hacked

The attack on Kelp occurred on Saturday, when the attacker exploited a vulnerability in a cross-chain bridge responsible for transferring the rsETH token between different networks. The attacker managed to withdraw 116,500 rsETH — about 18% of the total circulating supply and roughly $300 million, according to The Block.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

The Kelp team did not respond immediately: the first actions came approximately 46 minutes after the attack. The protocol’s contracts were urgently paused, which blocked further attempts to withdraw funds. This proved effective — two subsequent transactions attempting to withdraw another 40,000 rsETH, or around $100 million, were rejected.

After that, Kelp officially confirmed the incident and suspended rsETH operations on the Ethereum mainnet and several Layer-2 networks. At the same time, LayerZero, auditors, and external security experts joined the investigation.

What Kelp and rsETH are

So what is Kelp? It is a liquid restaking protocol. It allows users to deposit ETH or related assets and receive rsETH in return. This token ensures that capital is not locked: it can be used in other DeFi protocols while the underlying asset continues to generate yield within the restaking system.

At the time of the attack, around 630,000 rsETH were in circulation, and the token was deployed across more than 20 networks, including Ethereum, Arbitrum, Base, Linea, Blast, Mantle, and Scroll. This broad integration made the incident especially sensitive for the market: rsETH was used not only within Kelp but also across other protocols as collateral, liquidity, and a financial instrument.

This is not the first incident involving Kelp in the past 12 months. In April 2025, the protocol paused deposits and withdrawals after a bug in its fee contract caused excessive minting of rsETH. At that time, the team stated that user funds were not affected.

Impact on Aave

The consequences of this attack were far more significant and directly affected Aave — the largest DeFi lending protocol. The attacker used the stolen rsETH as collateral to borrow liquidity on Aave V3, primarily in the form of wrapped Ether (wETH). As a result, the platform accumulated around $195 million in so-called “bad debt” — funds that cannot be recovered through standard liquidation mechanisms.

Loading...

The tweet was deleted by the author.

But we saved everything 🙂.

As a result, users began actively withdrawing funds. According to DeFiLlama, Aave’s total value locked (TVL) dropped from approximately $26.4 billion to $17.7 billion over the weekend. Major players withdrew liquidity: for example, the MEXC exchange withdrew about $431 million, while Abraxas Capital withdrew around $392 million.

At the same time, the USDT and USDC stablecoin pools on Aave V3 reached 100% utilization. This means that funds are практически impossible to withdraw: as of Monday morning, only about $2,500 was available for withdrawal from the $2.87 billion USDT pool. The protocol froze rsETH markets, as well as certain wETH operations across multiple networks, to prevent further risk from spreading.

The domino effect in DeFi

The scale of the Kelp incident is directly tied to how DeFi is structured. The rsETH token was used across multiple services — as collateral, a liquidity source, and part of trading strategies. According to analysts, at least nine protocols had direct or indirect exposure to this asset and were forced to pause operations following the attack.

This situation highlights a core feature of DeFi — the interconnectedness of protocols. A single failure in infrastructure, in this case a cross-chain bridge, led to issues across multiple parts of the ecosystem: from liquidity to lending. This interdependence is what turns an isolated exploit into a systemic crisis.

In the end, the Kelp hack was not just an isolated incident, but a clear example of how quickly risk can spread across the entire DeFi ecosystem. The use of the same asset across multiple protocols increases capital efficiency, but also makes the market more vulnerable to cascading failures. Even a single exploit can trigger liquidity shortages, bad debt, and a loss of confidence across several major players.

This material may contain third-party opinions, none of the data and information on this webpage constitutes investment advice according to our Disclaimer. While we adhere to strict Editorial Integrity, this post may contain references to products from our partners.