Kelp Pauses rsETH Contracts After ~$293M Exploit Spills Into DeFi Lenders

Kelp paused rsETH smart contracts after a Saturday attack drained about $293 million, then the shock propagated into integrated DeFi venues. The episode is being framed as a contagion event, with major lenders moving to freeze rsETH markets or adjust risk controls.

Key Takeaways

• Kelp halted rsETH smart contracts after a Saturday cyber attack drained about $293 million.
• Defensive actions spread quickly across DeFi, with at least nine protocols and platforms freezing rsETH markets or taking mitigation steps.
• Aave, Fluid, Compound Finance, SparkLend, and Euler were among the named venues that moved to contain rsETH exposure.
• Curve founder Michael Egorov tied the incident’s root cause to cross-chain bridging architecture and warned that non-isolated lending can transmit collateral risk across an entire platform.

Kelp Pauses rsETH After ~$293M Drain

Kelp, a liquid restaking protocol, paused smart contracts for its restaking token rsETH after a Saturday cyber attack that drained about $293 million. The pause is the cleanest immediate lever a protocol has when it suspects ongoing risk, but it also signals something traders hate: uncertainty about timing, remediation, and the final accounting of losses.

The market-structure detail that matters is not just the size of the drain. It is that rsETH is designed to be used elsewhere. Liquid restaking turns a restaked position into a tradable token that can be deployed across DeFi, which is exactly why a failure at the token layer can become a failure across venues that accepted it as collateral or liquidity.

Michael Egorov, founder of Curve Finance, framed the incident as a learning experience for DeFi and linked it to a broader security backdrop. Losses from crypto hacks, code exploits and scams totaled $482 million in Q1 2026, putting this event inside an already elevated risk regime.

rsETH Freezes Spread Across Major Lenders as Contagion Hits

The cascade was fast enough that security teams are treating it as an ecosystem event, not a single-protocol incident. Blockchain security firm Cyvers described the Kelp incident bluntly: “This was not just a protocol exploit. It immediately became a cross-protocol contagion event,” a characterization that fits the observed response pattern across integrated venues.

Cyvers said at least nine DeFi protocols and platforms were affected and took action to freeze rsETH markets or mitigate fallout. The named examples matter because they are core plumbing for leveraged DeFi positioning: Aave, Fluid, Compound Finance, SparkLend and Euler.

The packet does not enumerate each venue’s exact mitigation steps beyond freezing rsETH markets or taking actions to reduce exposure. That missing granularity is itself a risk input for traders. When you do not know whether a venue tightened parameters, disabled borrowing, halted deposits, or ring-fenced liquidations, you cannot cleanly model second-order effects like forced deleveraging, collateral haircuts, or liquidity fragmentation.

What stands out here is the time-to-contagion. Cyvers CEO Deddy Lavid put the operational lesson in one line: “The challenge is no longer just preventing exploits at the contract level, but understanding how fast they can cascade across integrated protocols,” which is effectively a warning that integration speed has become a risk multiplier.

Non-Isolated Collateral: Why One Token Can Stress an Entire Lending Stack

Egorov’s critique targets lending market design, not just exploit prevention. He said non-isolated lending, including earlier versions of Aave, exposes users to risks from all tokens used as collateral on a platform. In practice, that means a compromised collateral can become everyone’s problem, even for users who never touched that asset directly.

The distinction is straightforward but brutal in its implications. In a non-isolated design, collateral assets share a common risk surface through the platform’s balance sheet mechanics. If one collateral token becomes impaired, the platform has to defend solvency and orderly liquidations across the whole stack. In an isolated market setup, risk is ring-fenced to a specific asset market, which can contain contagion but often reduces capital efficiency.

Egorov also argued that DeFi teams should prospective collateral assets to ensure tokens do not have single points of failure or obvious attack surfaces before listing them as lending collateral. That is a governance and market-structure point, not a code- point. The listing decision is where protocols choose whether they are importing an external risk surface into their own liquidation engine.

He went further on the likely attack surface. Egorov warned that cross-chain bridging architecture was the root cause of the weekend’s Kelp exploit and urged careful, limited use of cross-chain infrastructure. “Cross-chain is hard and potentially risky. Only use cross-chain infrastructure when absolutely necessary, and do it really carefully,” he said.

The packet does not provide a technical breakdown of how the bridge architecture was exploited, so the root-cause claim remains an assertion rather than a fully evidenced post-mortem. Still, the framing matters because it points traders toward where future risk may cluster for composable restaking tokens: wherever cross-chain components sit in the trust model.

Signals Traders Should Track After the rsETH Shock

Kelp’s next updates are the primary clock. Traders need clarity on how long rsETH contracts remain paused, what remediation steps are being taken, and whether the “about $293 million” loss figure is confirmed or revised.

The second signal is how and when affected venues reopen rsETH markets, if they reopen at all. Watch for parameter changes across Aave, Compound Finance, Euler, SparkLend, and Fluid, including whether rsETH returns with tighter risk settings or remains frozen as protocols reassess collateral assumptions.

Third, the scope is still incomplete. Cyvers described “at least nine” impacted protocols and platforms, but only a subset is named in the packet. Additional disclosures that identify the full set of affected venues and specify what “mitigation” meant in each case will determine whether this was a contained shock or a broader integration stress test.

Finally, the market will need more technical detail on the alleged cross-chain bridging root cause. If the exploit path is confirmed to be bridge-related, the next question becomes whether other cross-chain-integrated restaking tokens share similar exposure.

Marcus Hale’s Take: DeFi Risk Is Now About Integration Speed, Not Just Smart-Contract Bugs

I’m treating this as an ecosystem risk event because that is how it behaved. Kelp’s pause and the ~$293 million drain are the spark, but the defining feature is that at least nine downstream venues had to freeze rsETH markets or take mitigation steps. When core lenders are forced into defensive posture, the risk is no longer isolated to the hacked protocol’s users. It becomes a question of how quickly integrated balance sheets can be protected without breaking market function.

The pattern worth noting is that composability compresses reaction time. Cyvers’ “cross-protocol contagion” label and Deddy Lavid’s point about cascade speed are basically the same message from two angles: the operational window between exploit and ecosystem response is shrinking. That changes what “risk management” means in DeFi. It is less about whether a single contract can be exploited and more about whether integrated venues can detect exposure and flip the right switches before impaired collateral propagates into liquidations and bad debt.

I see three scenarios, and each has clear confirmation points.

Scenario one is containment with tighter market structure. Confirmation would look like Kelp publishing remediation steps and maintaining the pause until the exploit surface is addressed, while lenders that froze rsETH reopen with stricter parameters or more isolated configurations. That would validate Egorov’s argument that collateral listing and market design choices are as important as exploit prevention, because the response would be structural rather than cosmetic.

Scenario two is partial reopening with lingering uncertainty. That is where Kelp updates remain thin, the ~$293 million figure stays “about” rather than finalized, and venues reopen unevenly with unclear mitigation details. Confirmation here is informational, not price-based: fragmented disclosures, inconsistent venue actions, and no shared narrative on root cause. In that environment, traders are left managing operational risk across venues, not just market risk.

Scenario three is a broader bridge-driven repricing of composable restaking risk. Egorov explicitly pointed to cross-chain bridging architecture as the root cause and urged minimal use of cross-chain infrastructure. If subsequent technical detail supports that claim, the confirmation point is straightforward: more protocols treat cross-chain components as first-class risk variables in collateral decisions, not as implementation details.

The core thesis is simple: if rsETH stays constrained until venues either isolate it or materially tighten risk settings, it confirms that integration speed and non-isolated collateral design, not just the initial bug, are now the dominant drivers of DeFi contagion.

Sources

• Cointelegraph