Luisa Crawford
Apr 19, 2026 17:45
Kelp liquid restaking hack cascaded via Aave, Compound, and seven different DeFi platforms. rsETH down 23% as trade debates remoted lending dangers.
A $293 million exploit of liquid restaking protocol Kelp DAO has rippled throughout the DeFi ecosystem, forcing no less than 9 main platforms to freeze markets or scramble harm management measures in what safety researchers are calling a “cross-protocol contagion occasion.”
The assault, which focused Kelp’s rsETH adapter bridge contract on Saturday, did not keep contained. Aave, Compound Finance, Fluid, SparkLend, and Euler all took emergency motion to freeze rsETH markets because the exploit’s shockwaves unfold via interconnected lending swimming pools.
rsETH has cratered 23% previously 24 hours, buying and selling at $1,962 with a market cap of $1.23 billion as of Sunday afternoon.
The Cross-Chain Drawback
Curve Finance founder Michael Egorov pointed to non-isolated lending because the core vulnerability that allowed localized harm to grow to be systemic. Earlier variations of Aave and comparable protocols expose customers to dangers from each token accepted as collateral—when one fails, everybody holding positions in that pool will get damage.
“Cross-chain is tough and probably dangerous. Solely use cross-chain infrastructure when completely needed, and do it actually fastidiously,” Egorov mentioned, noting that Kelp’s bridge structure was the assault’s entry level.
His recommendation for DeFi groups: vet tokens for single factors of failure earlier than approving them as collateral. Simpler mentioned than achieved when yield-hungry protocols race to combine the newest restaking derivatives.
A Sample Rising
This wasn’t an remoted incident. The Kelp exploit follows final week’s $280 million Drift Protocol hack and no less than 12 different crypto platform assaults earlier this month. Q1 2026 losses from hacks, exploits, and scams already hit $482 million earlier than this weekend’s occasions.
Blockchain safety agency Cyvers mapped how the stolen funds moved via Twister Money and transformed to ETH throughout a number of networks—a now-familiar laundering playbook.
“The problem is not simply stopping exploits on the contract degree, however understanding how briskly they will cascade throughout built-in protocols,” Cyvers CEO Deddy Lavid advised Cointelegraph.
What Occurs Subsequent
Kelp has paused all rsETH sensible contracts whereas investigating. The protocol, based by the crew behind Stader Labs, constructed its enterprise on simplifying restaking by letting customers deposit liquid staking tokens and obtain rsETH—a token that might then be used throughout DeFi for extra yield.
That composability, which made Kelp enticing, additionally made it harmful. When rsETH grew to become nugatory collateral in a single day, each protocol that accepted it confronted the identical drawback concurrently.
For merchants with publicity to any of the 9 affected platforms, the fast precedence is checking place well being and monitoring bulletins from protocol governance. The broader query—whether or not DeFi’s interconnected structure creates unacceptable systemic threat—will not be answered this week. But it surely’s getting tougher to disregard.
Picture supply: Shutterstock
