A devastating $292 million exploit has sent shockwaves through the cryptocurrency industry, laying bare the vulnerabilities in DeFi infrastructure and sparking fears of a ripple effect across lending protocols. As investigations continue, preliminary analysis indicates that the attack was centered on Kelp's rsETH token, a yield-bearing version of ether, and the mechanism for transferring assets between blockchains.
The perpetrator appears to have manipulated this system to create a large quantity of unbacked tokens, which were then used as collateral to borrow and drain real assets from lending markets, primarily from Aave, the largest decentralized crypto lender. This incident is the latest in a series of blows to DeFi, coming just weeks after the $285 million exploit of Solana-based protocol Drift, further eroding investor trust in the nearly $90 billion crypto sector. The attack's success can be attributed to a LayerZero bridge component, a critical piece of infrastructure enabling asset movement across different blockchains.
According to Charles Guillemet, CTO of Ledger, the system relied on a single-signer setup, allowing just one entity to approve transactions. This setup enabled the attacker to mint a large quantity of rsETH tokens without proper backing, which were then deployed to lending protocols, mostly Aave, to borrow real ETH.
The aftermath has left DeFi lending platforms holding collateral that may be challenging to unwind, while valuable and liquid assets have already been drained. Aave, for instance, saw a $6 billion drop in assets as users rushed to withdraw their funds, with the protocol's token down about 15% over 24 hours. The identity of the attacker and the exact nature of the exploit remain unclear, with key questions surrounding how the validator was compromised.
Despite the uncertainty, experts agree that the scale of the attack suggests a sophisticated actor. The incident serves as a stark reminder that as DeFi grows more interconnected, failures in one layer can quickly cascade across the system. While non-isolated lending models amplify the impact of such events, experts argue that DeFi will learn from this incident and become stronger.
However, the exploit has dealt a significant blow to investor confidence in the broader DeFi sector, with Guillemet warning that 2026 may become the worst year for hacks.