A staggering $292 million exploit has sent shockwaves through the crypto industry, exposing weaknesses in the underlying infrastructure of decentralized finance and raising concerns about the potential for a broader market meltdown. The attack, which occurred over the weekend, targeted Kelp's rsETH token and exploited a vulnerability in the mechanism used to transfer assets between blockchains. As a result, the attacker was able to create large quantities of tokens without proper backing, which were then used as collateral to borrow and drain real assets from lending markets, primarily from Aave, the largest decentralized crypto lender.
This incident is the latest in a string of high-profile exploits to hit the DeFi sector, coming just weeks after the $285 million exploit of Solana-based protocol Drift. The attack has significant implications for the nearly $90 billion crypto sector, further eroding investor trust in DeFi.
According to Charles Guillemet, CTO of hardware wallet maker Ledger, the exploit centered on a LayerZero bridge component, which enables assets to move across different blockchains. The system relied on a single-signer setup, meaning that only one entity could approve transactions, allowing the attacker to mint large amounts of rsETH. The tokens were then quickly deployed, with the attacker using them to borrow real ETH against, effectively shifting the problem from a single exploit to a broader market issue.
DeFi lending platforms are now left holding collateral that may be difficult to unwind, while valuable and liquid assets have already been drained. The incident has raised concerns about a potential 'bank run' dynamic, as users rush to withdraw funds.
Aave saw a significant drop in assets on the protocol, with users yanking their assets following the incident. The token associated with the protocol was down around 15% over the past 24 hours' trading. While investigations are ongoing, key questions remain around how the validator was compromised, with uncertainty over whether it was hacked, misconfigured, or misled.
The attacker's identity is also unknown, although the scale of the attack suggests a sophisticated actor. The exploit serves as another reminder that as DeFi grows more interconnected, failures in one layer can quickly cascade across the system. The incident has significant implications for the future of DeFi, with some arguing that non-isolated lending models amplify the impact of such events. However, others see a silver lining, with the crypto industry's ability to learn from and adapt to such incidents ultimately making it stronger.
Despite this, the trust in DeFi protocols has been eroded by this kind of event, and 2026 is likely to be the worst year for hacks, according to Guillemet.