KelpDAO rsETH exploit tied to LayerZero bridge default settings drains $292M
Security & Exploits ·
A $292M exploit of KelpDAO's rsETH via the LayerZero bridge has frozen 15+ protocols and pushed DeFi liquidity toward stressed Solana Kamino USDC pools, as the two projects trade blame over the root cause.
KelpDAO says the disaster traces to LayerZero's default settings, according to a report from coindesk.com, which puts the loss at roughly $290 million. LayerZero disputes that framing, arguing the exploit stemmed from how Kelp configured its Decentralized Verifier Network rather than a flaw in the bridge itself, per theblock.co. The Block's Asia and EMEA recap also notes that Arbitrum froze 30,766 ETH in response to the incident, part of the broader 15+ protocol freeze triggered across the ecosystem.
The exploit's market impact registered across major assets even as the incident centered on a single bridge integration: BTC fell to $75K (-1.05%), ETH to $2.3K (-1.70%), and OPEN to $0.40 (-1.30%), according to the signals digest. DeFi outflows have concentrated in Solana's Kamino USDC pools, which the digest describes as stressed at the 100 mark, suggesting liquidity pressure is spreading beyond the original Ethereum-based exploit site.
In response, LayerZero has committed 10,000 ETH to a DeFi United recovery initiative, split as a 5,000 ETH donation and 5,000 ETH earmarked to strengthen Aave market liquidity, with the effort described as Aave-led. The commitment also includes a pledge to improve OFT design specifically for lending markets, an acknowledgment that the bridge's token-transfer standard needs hardening even as LayerZero contests direct fault for the exploit.
Separately, fund laundering activity tied to the incident has been tracked moving across multiple chains, per wublockchain.xyz, though the destination and current status of those funds remain unclear. It is not yet resolved whether Kelp's DVN configuration or LayerZero's default parameters bear primary responsibility, nor how the 15+ frozen protocols will be unwound. The scale of the Kamino pool stress and whether DeFi United's 10,000 ETH commitment stabilizes Aave liquidity are still to be seen.