Security experts have flagged an apparent exploit of nearly $300 million from the liquid restaking protocol Kelp DAO. Blockchain sleuth ZachXBT first alerted the community to the suspicious outflow of $293.7 million from the protocol’s rsETH adapter. Kelp DAO has paused its rsETH contracts and is investigating with security experts, while Aave has frozen rsETH markets on its platforms as a precautionary measure.
Blockchain security experts flagged a nearly $300 million exploit of Kelp DAO on Saturday. The incident involved $293.7 million being drained from the protocol’s rsETH adapter.
First alerted by blockchain sleuth ZachXBT via his Telegram channel, the outflow was identified as suspicious cross-chain activity. Kelp DAO wrote on X that it had paused rsETH contracts and was investigating with security experts.
The world’s biggest DeFi project, Aave, also took action by freezing rsETH markets. “Aave’s contracts have not been exploited and this is an exploit related to rsETH,” the project’s official account stated.
Security firm Cyvers confirmed the hack, noting the funds were swapped back to Ethereum and Arbitrum. The attacker reportedly received funding from coin-mixer Tornado Cash to pay gas fees.
Kelp DAO is a liquid restaking protocol built on Ethereum. Users receive its rsETH token by depositing other liquid staking tokens into the adapter.
Aave founder Stani Kulechov wrote on X that the asset has no borrowing power on their platforms. He reassured users that the freeze was to assist Kelp DAO with its investigation.
This attack follows other recent major DeFi exploits. Cybercriminals hit Solana-based Drift Protocol for $295 million on April 1, and Balancer was hacked for $128 million in November.
