🧔♂️ A friendly human may check it before it goes live. More news here
Crypto restaking protocol Kelp Dao loses $292m in exploit
On April 18, Kelp DAO, a liquid restaking protocol under KernelDAO, said an attacker used LayerZero‘s cross-chain messaging system to drain 116,500 rsETH from its bridge, worth about US$292 million and equal to roughly 18% of the token’s circulating supply.
The company paused its core contracts 46 minutes later, and two later attempts to withdraw another 40,000 rsETH each failed, while the drained bridge reserve had backed wrapped rsETH issued on more than 20 networks, including Base and Arbitrum.
Several platforms, including Aave, SparkLend, and Fluid froze rsETH markets, while Lido halted new deposits into a product with rsETH exposure. Kelp said it is investigating the incident with partners and security firms.
🔗 Source: CoinDesk
🧠 Food for thought
Implications, context, and why it matters.
The exploit hit a flexible bridge setup
- Kelp’s rsETH runs on multiple blockchains, and its codebase refers to several cross-chain setups for rsETH across networks, including LayerZero and Chainlink Cross-Chain Interoperability Protocol (CCIP) deployments in older and newer versions 1.
- The attack hit the LayerZero version of the rsETH bridge 2.
- LayerZero lets developers set message checks through Decentralized Verifier Networks (DVNs), groups of independent parties that help confirm cross-chain messages 3.
- That flexibility leaves protocol teams and integrators with more work on message handling, execution paths, and troubleshooting 4.
- This case captures the security trade-offs in cross-chain design. GMX has discussed those choices in public while weighing bridge and messaging partners 3.
One token failure can spread through DeFi
- The fallout could reach beyond Kelp because rsETH sits inside many decentralized finance (DeFi) products.
- Before the attack, Kelp said it was live on more than 10 blockchains, and rsETH had more than US$300 million in liquidity across DeFi, including lending protocols and yield optimizers 5.
- Aave, SparkLend, and Fluid froze rsETH markets, steps that can curb wider damage when a common asset breaks.
- This event adds a concrete example to the debate over safer ways to manage cross-chain assets.
- It may bring more scrutiny to single-provider bridge security and lift interest in multi-provider designs, an option GMX discussed during its public tender process 3.
Stay updated on the go with our mobile app.
Get latest insights with smoother, more personalized experience through TIA mobile app.