KelpDAO Bridge Exploit Triggers $228M AAVE/Compound Drain; rsETH Slips to 82% of Peg

A KelpDAO-related bridge exploit tied to LayerZero sent shockwaves through DeFi over the weekend, pulling more than $228 million from AAVE and Compound, Arkham Intelligence said. LayerZero attributed the attack to the Lazarus Group. Arkham reported that the attacker used forged bridge-transfer messaging to fool LayerZero's verification flow and prompt KelpDAO's Ethereum bridge contract to release 116,500 rsETH. The move abruptly expanded rsETH availability on Ethereum and set off rapid withdrawals and liquidity strain across lending markets. Separate analysis from banteg suggests the exploit may have drained existing cross-chain inventory rather than minting fresh tokens. Before the incident, total rsETH supply was 629,689 tokens. Roughly 151,967 rsETH were held on other networks, including Arbitrum, Mantle and Base. After gaining access to the rsETH, the attacker posted it as collateral on AAVE and borrowed more than $200 million in ETH, consuming a substantial share of available rsETH liquidity and pressuring lending pools. As users repositioned, withdrawals surged on AAVE. Stablecoin supply caps hit their limits, tightening liquidity in USDC and USDT markets. Concentration risk amplified the impact: about 87.9% of rsETH supply is parked in AAVE and Compound. Across major chains, AAVE holds most rsETH deposits, with Ethereum hosting more than 525,000 rsETH, while Arbitrum, Mantle and Base each show over 90% concentration within AAVE. rsETH also broke its peg, trading near 82% of par on Ethereum as markets priced in uncertainty around backing and supply. KelpDAO is weighing recovery paths, including loss-sharing across holders, which could imply an rsETH value around 84% of peg, or prioritizing Ethereum mainnet holders for full backing while limiting recoveries for cross-chain users. Arkham noted roughly 40,374 rsETH were transferred to an Ethereum multisig, potentially consolidating remaining assets. Arkham added that AAVE users could face higher borrowing costs if liquidity remains constrained.