Nine protocols frozen after breach
A major security incident struck Kelp DAO, a liquid restaking protocol, over the weekend, resulting in the loss of nearly $293 million. The attacker targeted Kelp’s rsETH adapter bridge contract and managed to drain funds across mainnet and several Layer-2 networks. In the immediate aftermath, Kelp paused its smart contracts for rsETH, halting all restaking activity to prevent further damage.
The ripple effect was swift: at least nine different crypto protocols were impacted by the exploit and froze their own operations. According to cointelegraph.com, Aave responded by freezing its rsETH markets on both Aave V3 and V4, reflecting the interconnected risk that a single breach can pose to multiple DeFi platforms.
On paper, decentralized finance promises resilience through distributed systems, but this event highlights how vulnerabilities in one protocol can cascade across an entire ecosystem.
Tornado Cash traced to attacker
Blockchain analysis revealed that the attacker funded their activities using Tornado Cash, a privacy-focused coin mixer. Cyvers, a security firm monitoring the hack, noted that the perpetrator used these laundered funds specifically to cover gas fees for executing the exploit. After breaching the rsETH adapter, the attacker quickly converted approximately $250 million of the stolen assets into Ether (ETH), making it harder for investigators to track and recover the funds.
Nearly $300 million vanished from Kelp DAO’s ecosystem within hours.
See Also
Emergency pause blocked further drains
Kelp’s emergency pauser multisig—a special multi-signature wallet designed for crisis intervention—froze the protocol’s core contracts about 46 minutes after the initial exploit succeeded. This freeze was not just symbolic: it actively blocked two follow-up attempts by the attacker to siphon off more funds. While rapid action limited further losses, it could not reverse the damage already done during those critical first minutes.
Staking tokens plummet amid chaos
The market fallout was immediate. The price of Aave’s governance token (AAVE) tumbled 10% within 24 hours of news breaking about the exploit. Staked Ether derivatives such as stETH and wstETH also suffered declines of nearly 4%, reflecting shaken confidence among DeFi participants. These price drops underscore how deeply market sentiment is tied to security events—even if only one protocol is directly affected.
Crypto losses from hacks and scams reached $482 million in just Q1 2026, but this latest incident alone accounts for over half that amount. For context, Drift Protocol experienced a similarly large breach in April with $280 million drained—attributed to suspected North Korean state-affiliated hackers—showing that DeFi remains a high-value target for sophisticated attackers.
ZachXBT sounded alarm first
Blockchain investigator ZachXBT was among the first to alert the public about suspicious activity involving Kelp DAO’s rsETH adapter on Saturday via his Telegram channel. His early warning set off a chain reaction among security teams and other protocols relying on rsETH liquidity. Kelp DAO has since confirmed it is working with external security experts to investigate how such a large sum—$293.7 million—could be extracted so quickly and efficiently.
It’s unclear whether any of the stolen funds will be recovered or if users will see restitution in any form.
Next steps
If Kelp DAO or affected protocols such as Aave announce the unfreezing of rsETH contracts or markets in the coming days, this would immediately allow users to resume withdrawals and trading; however, the timeline for such actions remains unclear as Kelp DAO is still investigating the incident with security experts.
