A massive $292 million cryptocurrency heist has sent shockwaves through the financial sector, revealing significant weaknesses in the DeFi infrastructure and sparking concerns about potential ripple effects across lending platforms. The incident occurred over the weekend and is still under investigation, but initial findings suggest the attack was centered on Kelp's rsETH token and the mechanism used for transferring assets between different blockchain networks.
The perpetrator manipulated the system, creating a substantial amount of unbacked tokens, which were then utilized as collateral to borrow and drain actual assets from lending markets, primarily from Aave, the largest decentralized cryptocurrency lender. This incident is the latest in a series of blows to DeFi, occurring just a couple of weeks after the $285 million exploit of the Solana-based Drift protocol, further eroding investor trust in the nearly $90 billion cryptocurrency sector.
The attack exploited a LayerZero bridge component, which enables the transfer of assets between different blockchains. Typically, bridges function by locking assets on one chain and minting equivalent tokens on another, relying on a trusted entity to verify deposits.
In this case, Kelp acted as the verifier, but the system had a single-signer setup, allowing a single entity to approve transactions. According to Charles Guillemet, CTO of Ledger, the attacker was able to sign a message, enabling them to mint a large amount of rsETH, although it remains unclear how access was obtained. The same weakness was pointed out by Michael Egorov, founder of Curve Finance, who stated that problems can arise when a single party is trusted.
This setup allowed the attacker to create unbacked tokens, even though no corresponding assets were locked on the source chain. Once minted, the tokens were quickly deployed, with the attacker immediately depositing them in lending protocols, mostly Aave, to borrow real ETH against. This maneuver transformed the incident from a single exploit into a broader market issue, leaving DeFi lending platforms with collateral that may be challenging to unwind, while valuable and liquid assets have already been drained. As a result, Aave and other lending protocols may be holding hundreds of millions of dollars in questionable collateral and bad debt, raising concerns about a potential 'bank run' dynamic as users rush to withdraw funds.
Aave experienced a $6 billion drop in assets on the protocol as users withdrew their assets following the incident, with the associated token down about 15% over the past 24 hours. Key questions remain regarding how the validator was compromised, with uncertainty surrounding whether it was hacked, misconfigured, or misled.
The attacker's identity is also unknown, although Guillemet suggested that the scale of the attack implies a sophisticated actor. Beyond the immediate losses, the exploit serves as a reminder that as DeFi grows more interconnected, failures in one layer can quickly cascade across the system.
Egorov argued that non-isolated lending models amplify the impact of such events and pointed to shortcomings in how new assets are onboarded to lending platforms. However, he also stated that there is a silver lining, as 'crypto is a harsh environment which no bank would have survived — yet we are working with that,' and believes DeFi will learn from this incident and become stronger. Nevertheless, incidents like this lead to protocol upgrades and redesigns, but also erode investor confidence in the broader DeFi sector. 'All in all, the trust into DeFi protocols is eroded by this kind of event,' Guillemet said, adding that 2026 will likely be the worst year for DeFi hacks.