Kelp Protocol Loses $293 Million in Cross-Chain Bridge Attack

Kelp, a liquid restaking protocol, has experienced a significant security breach resulting in a loss of approximately $293 million. The incident occurred on April 17, with Cyvers AI reporting the attack as a massive exploit targeting Kelp's cross-chain bridge.

Analysts revealed that the attacker manipulated a flaw in the LayerZero platform's rsETH token. This breach began at 17:35 UTC when the hacker activated the lzReceive function, allowing the transfer of 116,500 rsETH to a personal wallet. The funds were funneled through Tornado Cash, a crypto mixing service.

The Kelp team responded within 46 minutes of detecting the unusual activity by implementing an emergency pause on the rsETH token. This action halted associated protocol components to prevent further loss. "We have paused rsETH contracts across all mainnet and several L2s while we investigate," Kelp representatives stated, emphasizing their collaboration with LayerZero, Unichain, and security experts.

In response to the exploit, other platforms, including DeFi protocol Aave, also suspended rsETH markets on their V3 and V4 platforms. After Kelp's intervention, the assailant attempted two additional transactions to withdraw 40,000 rsETH (roughly $100 million), but both were successfully blocked.

This incident marks Kelp's second cybersecurity challenge in a year, following an error in April 2025 involving excessive creation of rsETH due to a faulty fee agreement. Despite the breach, CoinGecko indicates that the value of the affected coin has not been drastically impacted, although the stolen amount represents about 18% of its total circulating supply. However, the attack has raised concerns in the market, leading to a nearly 20% drop in the price of AAVE amid fears of potential non-repayable loans.