
How did a single config crash the entire market?
This is one of those moments where a single mistake impacted everyone.
Not a bug. Not a contract hack. KelpDAO just showed where the real risk in DeFi lies.
What happened:
On April 18 at 20:35 (MSK), a hacker minted 116,500 rsETH (~$293M);
That’s about 18% of the total supply, and these tokens were completely unbacked;
How: the bridge via LayerZero was configured with requiredDVNCount = 1.
What does that mean?
The hacker sent a fake cross-chain message through LayerZero, gained access to KelpDAO’s escrow, and withdrew 116,500 rsETH (~$293M).
And that’s not even the worst part — instead of dumping the tokens, the hacker used them as collateral.
So what happened next:
The hacker deposited rsETH into Aave;
Then borrowed 52,834 WETH (Ethereum) and 29,782 WETH + 821 wstETH (Arbitrum);
In total, extracted around $200–236M.
Part of the funds was moved to Tornado within ~20 minutes. DEXs weren’t even touched to avoid crashing the price.
Who got hit:
rsETH holders from KelpDAO;
Umbrella stakers (Aave): $177M deficit, 60–70% slashing;
Aave lost $6B TVL overnight, market panic followed;
Pendle, Yearn, Ethena, Beefy: all started freezing positions urgently.
And the most interesting part — there was no “hack” in the usual sense:
KelpDAO contracts worked fine. EigenLayer wasn’t touched. LayerZero as a protocol is fine.
The entire issue came down to a bridge configuration mistake.
Full breakdown: https://defiprime.com/kelpdao-rseth-exploit
Now think about the risks — are those APYs from second-tier protocols really worth it?