KelpDAO Exploit Drains $228M from AAVE, rsETH Depegged to 82%

• Exploit linked to Lazarus Group used fake bridge messages to release 116,500 rsETH, inflating supply or draining inventory.
• Attackers borrowed over $200M in ETH on AAVE using rsETH collateral, causing liquidity stress and withdrawal surges.
• rsETH fell to ~82% of peg as KelpDAO considers loss-sharing or mainnet-priority recovery amid DeFi market strain.

A major exploit tied to KelpDAO and LayerZero shook DeFi markets over the weekend, draining over $228 million from AAVE and Compound, according to Arkham Intelligence. The attacker, identified by LayerZero as the Lazarus Group, manipulated bridge messaging to access 116,500 rsETH. The incident led to fast withdrawals and liquidity stress across lending markets.

According to Arkham Intelligence, the attacker submitted a fake transfer to LayerZero’s verification system. This action tricked KelpDAO’s Ethereum bridge contract into releasing 116,500 rsETH. As a result, the circulating supply on Ethereum increased unexpectedly.

However, separate research from banteg indicates the attacker drained existing cross-chain inventory rather than minting new tokens. Before the exploit, total rsETH supply stood at 629,689 tokens. At the time, 151,967 rsETH existed across other chains, including Arbitrum, Mantle, and Base.

Following the exploit, the attacker used rsETH as collateral on AAVE. They borrowed over $200 million in ETH, representing a large share of rsETH liquidity. This move placed immediate pressure on lending pools.

As users reacted, withdrawals surged across AAVE. Stablecoin supply caps reached limits, reducing available liquidity for USDC and USDT markets. Notably, about 87.9% of rsETH supply sits within AAVE and Compound.

Across major chains, AAVE holds the majority of rsETH deposits. Ethereum accounts for over 525,000 rsETH, while Arbitrum, Mantle, and Base each show over 90% concentration within AAVE.

Meanwhile, rsETH dropped to roughly 82% of its original value on Ethereum. This decline reflects market reaction to increased supply and uncertainty. KelpDAO now faces key decisions regarding loss distribution.

One option involves spreading losses across all holders, which could value rsETH near 84% of its peg. Another approach prioritizes Ethereum mainnet holders, offering full backing while limiting recovery for cross-chain users.

Additionally, about 40,374 rsETH moved to an Ethereum multisig, possibly consolidating remaining assets. According to Arkham Intelligence, AAVE users may face rising borrow costs if liquidity remains constrained.