Kelp's $293M Collapse Exposes DeFi's Weakest Link: Cross-Protocol Contagion

Kelp's liquid restaking protocol got hit hard on Saturday—and the fallout is spreading across the entire ecosystem. A sophisticated attacker drained roughly $293 million from the platform by exploiting the rsETH adapter bridge contract, triggering what blockchain security firm Cyvers is calling a "cross-protocol contagion" affecting at least nine crypto projects.

The Attack Breakdown

Here's what went down: attackers targeted the smart contract managing Kelp's rsETH restaking token, gaining access to the bridge adapter and siphoning off the funds. The speed of the exploitation was particularly concerning—Kelp discovered the suspicious cross-chain activity and immediately paused rsETH contracts across mainnet and multiple Layer-2 networks, but not before the damage was done.

The attacker moved fast to obscure the trail. They used a Tornado Cash crypto mixer-funded address to conduct the initial transaction, then converted approximately $250 million of the stolen funds into Ether (ETH), according to Cyvers' analysis. This rapid conversion to ETH is a telltale sign of a professional operation—they're moving quickly to liquidity and away from blockchain forensics.

Ripple Effects Across DeFi

The real problem here isn't just Kelp's loss. It's the interconnected nature of modern crypto. Major platforms with exposure to rsETH immediately moved to contain the damage. Aave, one of DeFi's largest lending protocols, froze rsETH markets across both Aave V3 and V4. That's not a minor containment move—it signals serious systemic risk in the ecosystem.

At least nine protocols have now suspended trading or activity related to rsETH tokens, according to Cyvers. This cascading effect demonstrates exactly why DeFi composability, while powerful for innovation, creates massive vulnerability when one protocol gets compromised.

Deddy Lavid, CEO of Cyvers, nailed the core issue: "This is exactly the kind of incident that highlights the risks of composability in DeFi." He's right. When protocols are locked together like building blocks, one structural failure threatens the entire stack.

Part of a Larger Pattern

This isn't an isolated incident. The Kelp exploit adds to a grim Q1 2026 scorecard: crypto losses from hacks and scams totaled approximately $482 million across the quarter. Just months earlier, Drift Protocol suffered a $280 million exploit in April—an attack the team later revealed involved suspected North Korean state-affiliated hackers who had infiltrated the organization over months through initial contact at a major crypto conference.

The Drift hack's post-mortem revealed the sophistication of modern crypto attacks: the infiltrators gained developer machine access and deployed malware before executing the exploit. It's not just random opportunism anymore—these are coordinated, patient operations targeting fundamental infrastructure.

Cointelegraph reached out to Kelp for comment but received no response at the time of publication. The platform's silence, while understandable given the chaos, leaves investors without official guidance on recovery plans or timelines.