Kelp DAO rsETH Bridge Exploit Triggers $292 Million DeFi Security Crisis

A suspected exploit on Kelp DAO’s LayerZero-based rsETH bridge has triggered one of the largest DeFi security incidents in recent months, with estimated losses of 116,500 rsETH—roughly $292 million—while broader market risk sentiment deteriorated amid renewed tensions around the Strait of Hormuz.

Kelp DAO said it detected ‘suspicious cross-chain activity’ tied to rsETH and responded by pausing rsETH contracts across mainnet and multiple Layer 2 networks. The team said it is working with security specialists to investigate the incident and will publish additional updates as details become clearer.

The scale of the reported loss immediately raised concerns about second-order effects across Ethereum (ETH)-based lending markets, where liquid restaking tokens are widely used as collateral. Spark Protocol’s strategy lead, monetsupply.eth, warned on X that the rsETH shock could collide with already-tight stablecoin liquidity conditions and escalate into a broader DeFi stress event.

According to the Spark executive, around 16.5% of the ETH market is currently ‘supported’ by rsETH-linked exposure, implying that disorderly repricing could ripple across both mainnet and cross-chain venues. If losses are recognized unevenly across venues, rsETH-collateralized positions in ‘eMode’—a high-efficiency lending setting used by borrowers for increased leverage—could face a 10% to 15% discount, he wrote. Once risk buffers are depleted, he added, ETH depositors could still be left with residual losses in the 2% to 3% range.

He also described a scenario in which anxious suppliers try to withdraw funds simultaneously, pushing lending markets toward a ‘utilization’ ceiling that effectively locks liquidity in place. In such an environment, borrowing rates may not rise enough to force leveraged positions—such as those involving wrapped staked ETH variants like wstETH and weETH—into rapid deleveraging, slowing the system’s ability to self-correct. Borrowers who used ETH as collateral to borrow stablecoins such as Tether (USDT) could also struggle to unwind positions if ETH withdrawals become constrained, weakening normal market balancing mechanisms even as rates rise, he said.

As a precaution, several major protocols moved to reduce cross-chain exposure while the rsETH situation is assessed. etherFi said it temporarily halted its LayerZero bridges for weETH and eETH until the incident’s root cause is confirmed. The project stated that its Liquid vaults were not directly exposed, but it paused Teller contracts connected to products including Liquid (ETH, BTC, USD), sETHFI, and eBTC to cut off LayerZero OFT bridge routes, alongside suspending related deposits and withdrawals.

Sky also paused cross-chain bridging for USDS OFT, describing the move as a preventative measure to evaluate any downstream impact tied to the external security event. The protocol said its systems and the USDS contract were not affected and emphasized that USDS remains fully collateralized by design, with on-chain reserves verifiable at any time.

Risk assets were simultaneously pressured by headlines out of the Middle East. UK-linked maritime reporting cited renewed disruptions to vessel navigation in the Strait of Hormuz on Friday ET, after radio warnings indicated Iranian armed forces had resumed strict control and monitoring of the waterway. Maritime security firm Ambrey separately reported signs of attacks involving three ships near the strait, including reports of gunfire following warnings attributed to Iran’s Islamic Revolutionary Guard Corps. One container vessel was said to have been hit by an unidentified projectile roughly 25 nautical miles northeast of Oman, damaging part of its cargo.

Adding to uncertainty, Iranian media reported that Tehran has not decided whether to dispatch a negotiating delegation and would not enter talks while a maritime blockade persists. Iraq’s oil ministry officials also warned that a closure of the Strait of Hormuz could disrupt about 4 million barrels of Iraqi crude exports over the following three days—an outcome that would likely amplify volatility across energy markets and spill into ‘risk-on’ assets, including cryptocurrencies.

In trading, Bitcoin (BTC) fell below $75,000, changing hands at $74,973 on OKX, down 1.57% over 24 hours. Ethereum (ETH) slipped under the psychologically important $2,300 level to $2,299.68, down 2.71% on the day.

Separately, on-chain monitoring drew attention to a large withdrawal by Tron founder Justin Sun. According to analyst Ai Yi, a wallet linked to Sun withdrew 53,665 ETH—worth about $126 million—from Aave roughly five hours earlier on Friday ET. The funds remained in the wallet at the time of reporting, with no confirmed transfers to exchanges or evidence of a sale.

The rsETH incident underscores how ‘cross-chain’ infrastructure and restaking-linked collateral have become systemic components of DeFi liquidity. With major issuers and lending platforms now moving defensively, the market’s next focus will be on forensic findings from Kelp DAO and security partners—and whether precautionary pauses are enough to prevent a wider cascade.