A devastating $292 million exploit has sent shockwaves through the cryptocurrency industry, exposing weaknesses in the infrastructure of decentralized finance and sparking concerns about the potential ripple effects on lending protocols. The attack, which occurred over the weekend, targeted Kelp's rsETH token and the mechanism used for transferring assets between blockchains. The perpetrator manipulated the system to create a large quantity of unbacked tokens, which were then utilized as collateral to borrow and drain actual assets from lending markets, primarily from Aave, the largest decentralized crypto lender. This incident is the latest setback for DeFi, coming just a couple of weeks after the $285 million exploit of the Solana-based protocol Drift, further eroding investor trust in the nearly $90 billion crypto sector.
At its core, the exploit targeted a LayerZero bridge component, a critical piece of infrastructure that enables the movement of assets across different blockchains. According to Charles Guillemet, CTO of hardware wallet maker Ledger, the system relied on a single-signer setup, where only one entity could approve transactions. The attacker was able to sign a message, allowing them to mint a large quantity of rsETH, although it remains unclear how this access was obtained. Michael Egorov, founder of Curve Finance, pointed to the same weakness in the system's configuration, stating that such incidents can occur when trust is placed in a single party.
The setup allowed the attacker to create unbacked tokens, even though no corresponding assets were locked on the source chain. Once minted, the tokens were quickly deployed, with the attacker immediately depositing them in lending protocols, mostly Aave, to borrow real ETH against.
This maneuver transformed the problem from a single exploit into a broader market issue, with DeFi lending platforms now holding collateral that may be difficult to unwind, while valuable and liquid assets have already been drained. As a result, Aave and other lending protocols may be sitting on hundreds of millions of dollars in questionable collateral and bad debt, raising concerns about a potential 'bank run' dynamic as users rush to withdraw funds.
Aave experienced a significant drop in assets on the protocol, with users withdrawing their assets following the incident, and the token associated with the protocol declined by about 15% over the past 24 hours. Key questions remain unanswered, including how the validator was compromised and the identity of the attacker. The incident serves as a reminder that as DeFi grows more interconnected, failures in one layer can quickly cascade across the system. Egorov argued that non-isolated lending models amplify the impact of such events and that shortcomings in onboarding new assets to lending platforms should have been addressed earlier.
However, he also noted that the crypto environment, although harsh, can lead to growth and improvement. The exploit has eroded trust in DeFi protocols, and according to Guillemet, 2026 is likely to be the worst year for hacks, further undermining investor confidence in the sector.