Kelp DAO $293M Exploit Triggers DeFi-Wide Contagion Across 9 Protocols

Luisa Crawford Apr 19, 2026 17:45

Kelp liquid restaking hack cascaded through Aave, Compound, and 7 other DeFi platforms. rsETH down 23% as industry debates isolated lending risks.

Kelp DAO $293M Exploit Triggers DeFi-Wide Contagion Across 9 Protocols

A $293 million exploit of liquid restaking protocol Kelp DAO has rippled across the DeFi ecosystem, forcing at least nine major platforms to freeze markets or scramble damage control measures in what security researchers are calling a "cross-protocol contagion event."

The attack, which targeted Kelp's rsETH adapter bridge contract on Saturday, didn't stay contained. Aave, Compound Finance, Fluid, SparkLend, and Euler all took emergency action to freeze rsETH markets as the exploit's shockwaves spread through interconnected lending pools.

rsETH has cratered 23% in the past 24 hours, trading at $1,962 with a market cap of $1.23 billion as of Sunday afternoon.

The Cross-Chain Problem

Curve Finance founder Michael Egorov pointed to non-isolated lending as the core vulnerability that allowed localized damage to become systemic. Earlier versions of Aave and similar protocols expose users to risks from every token accepted as collateral—when one fails, everyone holding positions in that pool gets hurt.

"Cross-chain is hard and potentially risky. Only use cross-chain infrastructure when absolutely necessary, and do it really carefully," Egorov said, noting that Kelp's bridge architecture was the attack's entry point.

His advice for DeFi teams: vet tokens for single points of failure before approving them as collateral. Easier said than done when yield-hungry protocols race to integrate the latest restaking derivatives.

A Pattern Emerging

This wasn't an isolated incident. The Kelp exploit follows last week's $280 million Drift Protocol hack and at least 12 other crypto platform attacks earlier this month. Q1 2026 losses from hacks, exploits, and scams already hit $482 million before this weekend's events.

Blockchain security firm Cyvers mapped how the stolen funds moved through Tornado Cash and converted to ETH across multiple networks—a now-familiar laundering playbook.

"The challenge is no longer just preventing exploits at the contract level, but understanding how fast they can cascade across integrated protocols," Cyvers CEO Deddy Lavid told Cointelegraph.

What Happens Next

Kelp has paused all rsETH smart contracts while investigating. The protocol, founded by the team behind Stader Labs, built its business on simplifying restaking by letting users deposit liquid staking tokens and receive rsETH—a token that could then be used across DeFi for additional yield.

That composability, which made Kelp attractive, also made it dangerous. When rsETH became worthless collateral overnight, every protocol that accepted it faced the same problem simultaneously.

For traders with exposure to any of the nine affected platforms, the immediate priority is checking position health and monitoring announcements from protocol governance. The broader question—whether DeFi's interconnected architecture creates unacceptable systemic risk—won't be answered this week. But it's getting harder to ignore.

Image source: Shutterstock