Attack via a bridge and emergency shutdown of contracts

The KelpDAO story looks like a classic example of how in DeFi “one sneeze – and the entire ecosystem has a fever.” Formally, this is about the hack of a single protocol, but in reality it is already a mini-crisis at the level of an entire segment.

The largest attack on KelpDAO led to the loss of almost $300 million and a chain reaction in DeFi

The DeFi protocol KelpDAO was subjected to a large-scale attack, as a result of which the attacker withdrew about $293 million. According to analysts from Cyvers, the incident quickly went beyond a single project and triggered so-called “inter-protocol contagion,” affecting at least nine related services.

The KelpDAO team confirmed that it detected suspicious cross-chain activity around the rsETH token — one of the key elements of their liquid restaking. In response, the platform promptly suspended the operation of rsETH smart contracts both on the main Ethereum network and across a number of layer-two solutions.

The weak link turned out to be the rsETH bridge adapter — a component that enables the transfer of assets between different networks. It was through this component that the attacker gained access to liquidity and withdrew the funds. Such bridges have repeatedly become entry points for attacks — too much trust is concentrated in one place, and therefore the cost of an error is maximal.

According to Cyvers, the attacker used addresses pre-funded via the crypto mixer Tornado Cash, which complicates identification. Approximately $250 million has already been converted into ETH, significantly reducing the chances of a quick freeze or recovery of funds.

Independent blockchain analyst ZachXBT reported that the attack affected several ecosystems at once, including Ethereum and Arbitrum. He also published a list of addresses involved in the operation, which may help further investigation, although in such cases this is more of a “digital portrait of the criminal” than a guarantee of capture.

The market reaction followed almost instantly. The lending protocol Aave suspended rsETH markets in versions V3 and V4 to limit liquidation risks and further spread of the issue. Other projects with exposure to this asset also began urgently closing operations and revising risk parameters.

In essence, a domino effect was triggered: one problematic asset began to “infect” related protocols through collateral, liquidity, and derivatives mechanisms. This is exactly what makes DeFi both revolutionary and fragile.

The attack on KelpDAO clearly demonstrated the downside of DeFi’s main advantage — its composability. The ability of protocols to interact with each other creates a convenient and efficient financial system without intermediaries, but at the same time turns it into a tightly coupled network where an error in one node instantly spreads further.

Translated into plain language: in traditional finance, a fire is usually confined to one room, while in DeFi it easily spreads through the ventilation across the entire building.

That is why such incidents are becoming increasingly significant for the market. It is no longer just about the security of a specific protocol, but about the stability of the entire ecosystem. And as long as cross-chain bridges remain a weak point, such stories will, unfortunately, repeat themselves — with different scales, but with the same logic.