The $300 million KelpDAO exploit now appears to resemble a Layer 2 failure more than a direct outage on the Ethereum mainnet, with growing fears of DeFi contagion from cross-chain interactions in the community.
Sources granted anonymity reached out to Cryptopolitan and said they have “confidence that Core L1 ETH is not affected” and that the issue “lies in the L2s.”
the attacks I started by waiting for a wallet funded through Tornado Cash’s 1 ETH pool for about ten hours, then connecting to lzReceive on LayerZero’s EndpointV2 contract. This triggered KelpDAO’s bridge logic and released 116,500 rsETH to the attacker’s wallet.
The tokens were valued at approximately $292 million and constitute approximately 18% of rsETH’s circulating supply of approximately 630,000. Two other batches then targeted 40,000 rsETH each, or roughly another $100 million combined, but both were rolled back after KelpDAO’s emergency multisig implementation paused.
If the two additional attempts had succeeded, the total loss would have reached about $391 million, according to the sources.
Attackers dump rsETH into Aave and hack ZRO
The stolen rsETH was deposited into Aave V3 as collateral, and was then used to borrow large sums of ETH and WETH, with the funds routed back through Tornado Cash. This has increased Aave’s bad debt risk, with exposure estimated at $177 million.
Aave then froze all rsETH markets on both V3 and V4 and said the flaw was in rsETH, not its own contracts. SparkLend has closed its rsETH market. Liquid freezing activity. Upshift has temporarily suspended both High Growth ETH and Kelp Gain vaults. Exposure was also driven by products associated with Pendle, Compound, Euler, Beefy and Yearn.
Private briefings reviewed by Cryptopolitan point to a narrower trend than the market panic initially suggested.
Our sources said L1 rsETH remains fully supported and the related Aave market is “completely solvent.” One message stated that weETH is not affected, liquid vault management is operating as usual, and LiquidETH and LiquidUSD users will not experience withdrawals because excess borrowing costs from rising Aave will be covered.
“Out of an abundance of caution, rsETH remains frozen across Aave V3 and V4 and exposure to the incident is capped. WETH reserves also remain frozen on affected markets including Ethereum, Arbitrum, Base, Mantle, and Linea. Aave is actively working to validate the information and evaluating potential solutions.”
– ghost
Early investigations said the issue was enabled by a 1-of-1 DVN setup on the Kelp rsETH Unichain route to Ethereum, which allowed unsupported tokens to be launched on Ethereum without burning legitimate source.
Another source told us that another platform’s LayerZero OFT bridges use a minimum DVN setting of 2/2, scale to 3 on busier routes, and include ingress and egress rate limits. This exchange is still pausing all LZ OFT bridges as a precaution, but has also frozen its teller contract, the unit that handles deposits, withdrawals and minting shares.
Protocols stop withdrawals and wait for liquidity
According to sources, “borrowing rates on Aave have spiked and the Ethereum exit queue has filled up making delivery more difficult/more expensive.” Another said that Kelp had not yet decided how to cover the losses or distribute them to the community, and that the best case would be for the losses to fall only on the L2s where the exploitation occurred.
Deposits were frozen because late Oracle reports could lead to unfair minting of shares. The withdrawals were described as “not technically paused,” but could not be addressed without further clarity from Kelp and Aave.
Mellow is now looking for exit windows, but was unable to do so because premiums for switching from stETH to ETH were too high and the Ethereum exit queue was clogged. Teams stopped oracle updates because they did not know how to price rsETH after losses.
“We don’t know how to price rsETH,” one source said. “No news yet,” said another, when asked about progress from Kelp or Aave. In the worst case, losses were estimated at around 9,000 ETH.
Another estimate puts the probability of top tier depositors reaching 6.2% if losses reach level 1 and wider support points are not used. Separate messages said incoming protocol liquidity could arrive by Tuesday or Wednesday to help process larger withdrawals.
Ethervi has He said Its users on
“EtherFi Liquid vaults are not affected by the recent Kelp rsETH incident. Liquid vault users will not experience any withdrawals.”
Meanwhile, while all this was happening, we also received information that Vercel had been hacked and that the attacker had listed their customer data, source code, databases and keys for sale.
Vercel has already publicly announced on Telegram that it has “identified a security incident related to unauthorized access to its internal systems.”
