Lido flags 9% rsETH exposure in EarnETH vault as KelpDAO exploit fallout prompts pause

Lido Finance, Ethereum's largest liquid staking protocol, said its EarnETH vault has about 9% direct exposure to rsETH and has paused deposits and withdrawals while curators address fallout from the KelpDAO exploit. Lido said its core staking system was not impacted and that stETH and wstETH remain unaffected. In an April 23 update, Lido said Earn vault contributors are working with curators Veda and Mellow on two separate issues stemming from the incident: the vault's direct rsETH exposure and a liquidity squeeze across lending markets. KelpDAO was hit by one of 2026's biggest DeFi exploits on April 18. An attacker used a forged cross-chain message to release 116,500 rsETH from an Ethereum side adapter without a corresponding burn on the source chain. The stolen amount was valued at about $292 million and accounted for roughly 18% of rsETH in circulation at the time, triggering emergency risk actions across lending venues. Lido said the impact is not confined to rsETH holdings. Elevated borrowing costs and tighter liquidity in lending markets have affected strategies tied to the vault, with Veda and Mellow reducing leverage and cutting wETH debt in impacted positions. Lido added that EarnETH still holds other positions unrelated to rsETH, and said rapid deleveraging has improved the vault's positioning as remediation continues. As part of the response plan, Lido said a $3 million first-loss backstop funded by the Lido DAO treasury would apply if EarnETH ultimately realizes losses, with the DAO's vault shares burned to absorb the hit. If remediation takes materially longer than expected, curators may add a last-resort withdrawal option allowing users to exit early by accepting the maximum expected haircut. Market stress spread after the attacker moved the illicit rsETH into lending protocols and borrowed ETH against it, prompting risk teams to freeze rsETH markets. Aave said its guardian froze rsETH and wrsETH markets across deployments on April 18. The shock hit protocols relying on looped staking strategies, including products using rsETH inside lending structures. Lido said its DVV and EarnUSD vaults have no exposure to Kelp's rsETH issue or the associated lending-market squeeze. It added that the GGV subvault does have exposure to looped staking strategies and is currently seeing negative yields due to the surge in borrowing rates. Users who submitted GGV withdrawal requests before the liquidity crunch will be redeemed at pre-incident valuations, Lido said. Recovery efforts continue. Arbitrum's Security Council froze about 30,766 ETH, worth roughly $71 million, linked to the exploit, raising the possibility that final losses could come in below the initial headline figure. Lido said it will provide further public updates as recovery and loss-allocation details develop.