Kelp DAO's rsETH bridge exploited for roughly $292 million
Security & Exploits ·
An attack exploiting a LayerZero-based vulnerability drained Kelp DAO's rsETH bridge, prompting an emergency pause and a cross-protocol scramble to contain the fallout.
Kelp DAO's rsETH bridge was apparently exploited for roughly $292 million in a LayerZero-based attack, according to The Block. The protocol's emergency pauser multisig froze rsETH's core contracts approximately 46 minutes after the successful drain, a response that blocked two follow-up attempts to exploit the same vulnerability.
The incident has triggered a coordinated recovery effort spanning several protocols. Aave, Kelp, and LayerZero have petitioned the Arbitrum DAO for governance approval to release $71 million in ETH that is currently frozen and held by the Arbitrum Security Council, directing those funds toward the cross-protocol recovery effort tied to the rsETH incident. The request has been raised in multiple governance proposals aimed at unlocking the frozen ETH.
Separately, a group of DeFi protocols including Mantle, Lido, and EtherFi have pledged 43,500 ETH in a coordinated effort to stabilize rsETH and contain systemic fallout from the exploit, underscoring the scale of cross-protocol exposure to the incident.
Polygon's Agglayer also became part of the story during the exploit weekend, processing $200 million in volume while its pessimistic proofs mechanism prevented unbacked withdrawals, according to a post shared on X.
What remains unresolved is whether the Arbitrum DAO will approve release of the $71 million in frozen ETH held by the Security Council, and how the combined recovery pledges, including the 43,500 ETH committed by Mantle, Lido, and EtherFi, will be applied against the roughly $292 million drained from the rsETH bridge. The exact mechanism of the LayerZero-based vulnerability and whether further follow-up attempts occurred beyond the two blocked by the emergency pause have not been detailed.