Lido Suspends EarnETH After rsETH Breach, Deploys $3M Buffer

Lido Earn halted deposits and withdrawal processing in its EarnETH vault after the Kelp rsETH incident exposed roughly 9% of the vault’s total value. According to an official update on X, Lido’s core staking protocol was not involved, and both stETH and wstETH remained unaffected. The response focused on containing vault-level risk while recovery work continued elsewhere.

The statement separated two problems inside EarnETH. One was direct exposure to rsETH. The other was a lending-market liquidity crunch that raised borrowing costs on leveraged positions. At the same time, the Arbitrum Security Council recovered about $70 million in ETH tied to the attack, while public updates on recovery and loss allocation were still developing.

Containment Narrowed to One Vault

The update further said only EarnETH had direct exposure to Kelp’s rsETH. That position accounted for about 9% of the vault’s TVL, making it the only affected Earn product. Meanwhile, deposits and withdrawal processing were paused by the vault curator while the resolution path was finalized.

Contributors said the curator was also working through positions unrelated to rsETH. Elevated borrowing rates across lending markets forced deleveraging and portfolio adjustments within the same vault. The team said those moves materially reduced wETH debt exposure. It also said optimization work on remaining holdings was still underway.

DAO Backstop Activated for Initial Losses

According to Lido’s report, if losses are confirmed after resolution, a $3 million first-loss protection mechanism will be applied by burning DAO-owned vault shares. The buffer is funded by the Lido DAO treasury and is meant to absorb initial damage before it reaches other EarnETH participants. That feature turned the treasury allocation into a direct shield for depositors during the incident.

Contributors also outlined a fallback route if the pause lasts materially longer than expected. Under that option, users could access withdrawals earlier by accepting the maximum anticipated haircut. The team described that path as a last resort rather than a default process. Requests submitted before the withdrawal pause are also under review.

Other Vaults Show Different Risk Profiles

Meanwhile, DVV, GGV, and EarnUSD had no direct exposure to Kelp’s rsETH, according to the status update. DVV and EarnUSD also avoided the lending-market liquidity strain, with deposits, withdrawals, and rewards continuing as usual. Their operating status contrasted sharply with EarnETH’s temporary shutdown.

GGV showed a different kind of stress, while its subvault uses looped staking strategies and is now facing negative yield rates during the borrowing-rate spike. Moreover, users who filed withdrawal requests before the liquidity crunch will be redeemed at pre-incident valuation. Later requests will be processed after liquidity conditions improve.

Fallout Spread Beyond EarnETH

Notably, the broader market reaction showed the incident did not stop at one vault. Santiment said that six days into the Kelp fallout, a refugee trade was emerging elsewhere in decentralized finance. Spark’s token rose from $0.029 to $0.058 in 48 hours, marking a 100% increase. Besides, whale transactions above $100,000 jumped from a baseline near 30 per day to 183.

Nonetheless, AAVE moved the other way. Santiment said it drifted lower near $92 even as Bitcoin had traded above $79,000 earlier in the week. Those figures showed a measurable redistribution of liquidity during the fallout. In that sense, Lido’s EarnETH pause was both a containment action and part of a wider market reshuffling already visible in on-chain activity.

Also Read: Arbitrum Freezes $100M+ in ETH Linked to KelpDAO Exploit