A stunning $292 million exploit has sent shockwaves through the cryptocurrency industry, laying bare the weaknesses in decentralized finance (DeFi) systems and sparking concerns over potential ripple effects across lending protocols. The attack, which occurred over the weekend, appears to have targeted Kelp's yield-bearing ether token, known as rsETH, and the mechanism used to transfer assets between different blockchains. By manipulating this system, the attacker was able to create a large quantity of tokens without proper collateral, which were then used as collateral to borrow and drain real assets from lending markets, primarily from Aave, the largest decentralized crypto lender.
This incident is the latest in a series of blows to DeFi, coming just a couple of weeks after the $285 million exploit of Solana-based protocol Drift, further eroding investor trust in the nearly $90 billion crypto sector. According to Charles Guillemet, CTO of Ledger, the attack exploited a LayerZero bridge component, a critical piece of infrastructure that enables the transfer of assets across different blockchains. The system relied on a single-signer setup, meaning that only one entity could approve transactions, which allowed the attacker to mint a large amount of rsETH tokens. Once minted, these tokens were quickly deployed, with the attacker using them as collateral to borrow real ether from lending protocols, mostly Aave.
This move transformed the exploit into a broader market issue, leaving DeFi lending platforms holding collateral that may be difficult to unwind, while valuable and liquid assets have already been drained. As a result, Aave and other lending protocols may be sitting on hundreds of millions of dollars in questionable collateral and bad debt, raising concerns of a potential 'bank run' dynamic as users rush to withdraw funds.
The incident has also raised questions about the security of DeFi systems, with experts warning that the trust in DeFi protocols is being eroded by such events. Despite the challenges, some experts believe that DeFi will learn from this incident and become stronger, with Michael Egorov, founder of Curve Finance, noting that 'crypto is a harsh environment which no bank would have survived — yet we are working with that.' However, the exploit has also sparked concerns over the potential for a 'worst year in terms of hacks' in 2026, with Guillemet warning that the trust in DeFi protocols is being eroded by such events.