#KelpDAOBridgeHacked 1. The Technical "Forged Message" Exploit

The attack was a masterclass in exploiting composability. The vulnerability sat within the bridge infrastructure (utilizing LayerZero) connecting KelpDAO’s rsETH across multiple chains.
The Forgery: Attackers crafted a malicious cross-chain payload that bypassed the verification layer. The bridge incorrectly "vouched" for the legitimacy of a massive deposit that never occurred on the source chain.
The Mint: This allowed the attacker to mint 116,500 rsETH out of thin air on the target chain.
The "Looping" Drain: Instead of selling the rsETH (which would have crashed the price immediately), the hackers deposited the fake rsETH as collateral on Aave V3, Compound, and Euler. They then borrowed real ETH and stablecoins against it.
Bad Debt: Because the collateral was essentially "valueless" (unbacked), the lending protocols are now facing a combined $230M+ in bad debt, as there is no real underlying asset to liquidate.
2. Market Impact & Contagion
The market's reaction reflects a fear of "Systemic DeFi Failure" rather than just a single protocol loss. 3. Current Recovery Status
As of Monday afternoon, April 20:
Protocol Status: KelpDAO has successfully paused all rsETH contracts on Mainnet and L2s (including Unichain).
Lending Caps: Aave and Compound have frozen rsETH markets. Users cannot deposit or borrow further, though existing positions are currently "trapped" until a resolution is reached.
Investigation: Security firms Cyvers and PeckShield are working with the LayerZero team to trace the funds, which are currently being funneled through privacy mixers.
4. Key Takeaways for 2026
This event marks the largest DeFi exploit of 2026 and highlights three critical failures:
Bridge Fragility: Even "omnichain" solutions are only as strong as their smallest verification loophole.
LRT Risk: Liquid Restaking Tokens (LRTs) create a "recursive" risk. When one asset is reused five times as collateral, a $300M hack can threaten $5B+ in total liquidity.
The "Speed" Problem: 46 minutes was all it took to drain the system. Traditional security "pausing" mechanisms are currently too slow to stop AI-enhanced or highly automated attack scripts.