A devastating $292 million exploit has sent shockwaves through the cryptocurrency industry, laying bare the weaknesses in decentralized finance (DeFi) infrastructure and prompting fears of a ripple effect across lending protocols. As investigations continue, preliminary analysis indicates that the attack was centered on Kelp's rsETH token, a yield-bearing variant of ether (ETH), and the mechanism facilitating asset transfers between blockchains. The perpetrator appears to have manipulated this system to create a substantial amount of unbacked tokens, which were then utilized as collateral to borrow and drain genuine assets from lending markets, primarily from Aave, the largest decentralized crypto lender. This incident is the latest in a series of blows to DeFi, occurring merely weeks after the $285 million exploit of the Solana-based protocol Drift, further eroding investor trust in the nearly $90 billion crypto sector.
The attack's mechanics involved targeting a LayerZero bridge component, a critical piece of infrastructure enabling asset movement across different blockchains. According to Charles Guillemet, CTO of Ledger, the system's single-signer setup, where just one entity could approve transactions, was exploited.
The attacker managed to sign a message, allowing for the minting of a large amount of rsETH, though the means by which this access was obtained remain unclear. Michael Egorov, founder of Curve Finance, highlighted the same vulnerability in the system's configuration, emphasizing the risks associated with trusting a single party. This setup enabled the attacker to create unbacked tokens, which were promptly deployed in lending protocols, primarily Aave, to borrow real ETH. The aftermath has left DeFi lending platforms holding potentially unwieldy collateral, while valuable and liquid assets have been drained.
Aave, for instance, has seen a significant drop in assets, with users withdrawing their funds, and the protocol's token experiencing a decline. Key questions surrounding the exploit remain unanswered, including how the validator was compromised and the identity of the attacker. The incident serves as a stark reminder of the interconnected nature of DeFi and the potential for failures in one layer to cascade across the system. While the episode may lead to protocol upgrades and redesigns, it also undermines investor confidence in the broader DeFi sector, with Guillemet predicting that 2026 will likely be the worst year for hacks.