Kelp, a liquid restaking protocol, was targeted in a cyberattack on Saturday, prompting the platform to pause smart contracts for its restaking token, rsETH, while it investigates the incident amid reports of hundreds of millions in losses.
“Kelp identified suspicious cross-chain activity involving rsETH earlier today. We have paused rsETH contracts across mainnet and several Layer-2s,” the platform said in an X post.
According to blockchain security firm Cyvers, the attacker exploited the rsETH adapter bridge contract—the code managing Kelp’s rsETH token—and drained roughly $293 million from the platform. Cyvers reported the attacker used an address funded via the Tornado Cash mixer and has converted about $250 million of the stolen funds to Ether (ETH).
In response, decentralized finance platform Aave froze rsETH markets on Aave V3 and V4. Cyvers said at least nine crypto protocols had exposure to rsETH and paused activity on their platforms to limit contagion.
“This is exactly the kind of incident that highlights the risks of composability in DeFi,” Deddy Lavid, CEO of Cyvers, told Cointelegraph. Cointelegraph reached out to Kelp but had not received a response by publication.
The Kelp exploit is the latest in a recent run of cyberattacks on crypto platforms. Losses from hacks and scams totaled about $482 million in Q1 2026, and several high-profile protocols have been targeted in recent months.
One notable recent incident involved decentralized exchange Drift Protocol, which suffered an exploit in April that drained about $280 million. Drift said the attack involved “months of deliberate preparation,” including infiltration of the team by suspected state-affiliated actors. In a post-mortem, Drift reported that attackers met team members at a major crypto conference, collaborated for months, deployed malware on developer machines, and ultimately compromised the platform.
Readers are encouraged to verify information independently. Cointelegraph is committed to independent, transparent journalism and produced this article in accordance with its Editorial Policy.