Historical report based on PANews’ April 21, 2026 roundup, published at 17:25 (UTC+8). Figures and response measures below reflect that reporting, not a current status update.
The Kelp DAO bridge attack put a central DeFi proposition under pressure: assets can move across networks and through lending strategies, but the risks attached to those assets do not disappear along the way.
PANews reported that the exploit involved approximately 116,500 rsETH, valued at about $292 million. The repercussions extended into Aave’s lending markets, Lido’s EarnETH vault and emergency intervention by Arbitrum’s Security Council. The unresolved question was not simply where the stolen assets had gone, but who would ultimately bear the shortfall.
From a bridge exploit to potential lending losses
According to Aave’s incident report, as summarized by PANews, the attacker forged cross-chain messages to release 116,500 rsETH from the Ethereum-side bridge. The attacker then deposited approximately 89,600 rsETH into Aave and borrowed around $190 million in ETH and related assets against it.
Aave froze its rsETH markets within hours and set the loan-to-value ratio to zero. Those measures restricted further exposure, but did not settle the potential bad debt already created.
The incident report outlined two possible outcomes:
- Losses shared across all rsETH holders: rsETH was expected to depeg by about 15%, leaving Aave with approximately $123 million in bad debt.
- Losses concentrated on layer-2 networks: Aave’s bad debt could reach approximately $230 million, mainly on networks including Arbitrum and Mantle.
These were conditional estimates, not finalized losses. The outcome depended on how Kelp DAO addressed the missing backing. Aave’s DAO treasury held approximately $181 million in assets, and discussions with ecosystem participants about covering potential losses were underway.
Containment did not mean normal operations had resumed
Arbitrum’s Security Council froze approximately 30,766 ETH associated with the attacker. The council said it worked with law enforcement after learning the attacker’s identity and moved the assets into an intermediary frozen wallet without affecting Arbitrum users or applications.
The original addresses could no longer access those funds. Any subsequent transfer required further Arbitrum governance action and coordination with relevant parties. The freeze was therefore a containment measure, not confirmation that losses had been reimbursed.
Aave separately reported that the WETH reserve on its Ethereum Core V3 market had been unfrozen, allowing users to supply WETH again. Its loan-to-value ratio remained zero. WETH reserves on Ethereum Prime, Arbitrum, Base, Mantle and Linea remained frozen at the time of the update.
How the exposure reached a yield vault
Lido said its EarnETH vault had approximately $21.6 million in rsETH exposure, representing about 9% of the vault, through a leveraged rsETH/ETH position on Aave.
The EarnETH team was deleveraging and reducing strategy risks. Deposits and withdrawals were paused, while the position’s eventual outcome depended on decisions by Kelp, LayerZero and Aave.
A $3 million first-loss protection mechanism supplied by the Lido DAO treasury was available if needed. Lido said its core staking protocol, including stETH and wstETH, was unaffected—a distinction that matters when assessing the exposure of a particular strategy rather than treating an entire ecosystem as equally compromised.
The security configuration behind the cross-chain narrative
Dune Analytics said its analysis of roughly 2,665 distinct LayerZero OApp contracts active during the preceding 90 days found that:
- 47% used a 1-of-1 decentralized verifier network, or DVN, configuration;
- 45% used a 2-of-2 configuration;
- approximately 5% used 3-of-3 or higher configurations.
Kelp DAO’s rsETH used a 1-of-1 configuration. Those figures describe verification arrangements; they do not establish that every application using a particular configuration was vulnerable to the same exploit.
Responding to recent DeFi attacks, Curve founder Michael Egorov argued that centralized points of failure were harming the industry. He called for shared security standards and for trust to be distributed where single points of failure could not be avoided.
The episode illustrates a boundary often obscured by the composability narrative: a bridge-dependent asset, a lending market and a leveraged yield vault are separate products, but their risks can remain connected. At the reporting date, containment was progressing while responsibility for the shortfall—and its final allocation—remained unresolved.
