Luisa Crawford
Apr 19, 2026 17:45
Kelp liquid restaking hack cascaded by Aave, Compound, and seven different DeFi platforms. rsETH down 23% as trade debates remoted lending dangers.
A $293 million exploit of liquid restaking protocol Kelp DAO has rippled throughout the DeFi ecosystem, forcing a minimum of 9 main platforms to freeze markets or scramble harm management measures in what safety researchers are calling a “cross-protocol contagion occasion.”
The assault, which focused Kelp’s rsETH adapter bridge contract on Saturday, did not keep contained. Aave, Compound Finance, Fluid, SparkLend, and Euler all took emergency motion to freeze rsETH markets because the exploit’s shockwaves unfold by interconnected lending swimming pools.
rsETH has cratered 23% previously 24 hours, buying and selling at $1,962 with a market cap of $1.23 billion as of Sunday afternoon.
The Cross-Chain Drawback
Curve Finance founder Michael Egorov pointed to non-isolated lending because the core vulnerability that allowed localized harm to change into systemic. Earlier variations of Aave and comparable protocols expose customers to dangers from each token accepted as collateral—when one fails, everybody holding positions in that pool will get harm.
“Cross-chain is tough and doubtlessly dangerous. Solely use cross-chain infrastructure when completely vital, and do it actually rigorously,” Egorov mentioned, noting that Kelp’s bridge structure was the assault’s entry level.
His recommendation for DeFi groups: vet tokens for single factors of failure earlier than approving them as collateral. Simpler mentioned than finished when yield-hungry protocols race to combine the newest restaking derivatives.
A Sample Rising
This wasn’t an remoted incident. The Kelp exploit follows final week’s $280 million Drift Protocol hack and a minimum of 12 different crypto platform assaults earlier this month. Q1 2026 losses from hacks, exploits, and scams already hit $482 million earlier than this weekend’s occasions.
Blockchain safety agency Cyvers mapped how the stolen funds moved by Twister Money and transformed to ETH throughout a number of networks—a now-familiar laundering playbook.
“The problem is now not simply stopping exploits on the contract degree, however understanding how briskly they’ll cascade throughout built-in protocols,” Cyvers CEO Deddy Lavid informed Cointelegraph.
What Occurs Subsequent
Kelp has paused all rsETH good contracts whereas investigating. The protocol, based by the group behind Stader Labs, constructed its enterprise on simplifying restaking by letting customers deposit liquid staking tokens and obtain rsETH—a token that might then be used throughout DeFi for added yield.
That composability, which made Kelp engaging, additionally made it harmful. When rsETH grew to become nugatory collateral in a single day, each protocol that accepted it confronted the identical downside concurrently.
For merchants with publicity to any of the 9 affected platforms, the instant precedence is checking place well being and monitoring bulletins from protocol governance. The broader query—whether or not DeFi’s interconnected structure creates unacceptable systemic danger—will not be answered this week. Nevertheless it’s getting tougher to disregard.
Picture supply: Shutterstock
