The $292M wake-up call

Hey,

I had some money in Kelp DAO when it got drained on Saturday.

Not life-changing, but enough to sting. I know the team, good people, sharp engineers, not the kind of project you'd flag as an obvious rug.

And yet $292M drained in under a minute.

The biggest DeFi exploit of 2026.

Let me walk you through it.

Saturday, 17:35 UTC. An attacker forged a message telling Kelp's bridge to release funds, like a fake wire-transfer instruction with a convincing signature. The bridge believed it and sent out 116,500 rsETH, roughly 18% of the entire supply, straight to the attacker.

46 minutes later, Kelp's emergency team froze the contracts. Two more attempts to steal another ~$100M bounced off. That response probably saved nine figures in damage. Credit where it's due.

But the damage was already done. And then it got worse 👇

The attacker deposited the stolen rsETH as collateral on Aave V3 and borrowed WETH against it.

The WETH left the system.

The collateral backing those loans? Worthless. Because the reserve that gave rsETH its value was the same reserve that just got drained.

Result:

Roughly $290M in effectively unliquidable positions sitting on Aave's books.

Classic bad debt.

Aave wasn't hacked, but now they have to decide who eats the loss.

Everyone with rsETH exposure went into defense mode:

Nobody froze because they got hacked. They froze because they couldn't tell which rsETH was backed and which wasn't: there are wrapped versions of it stranded across 20+ chains (Base, Arbitrum, Linea, Mantle, Blast, Scroll, and more).

Kelp had 1 DVN configured on their LayerZero bridge.

For comparison: EtherFi runs 2. Ethena runs 3. It's the weakest security configuration LayerZero allows.

And this wasn't a secret. A developer flagged it publicly on the Aave governance forum back in January 2025 (15 months before the exploit!) Told them to add a second DVN. Nothing changed.

I don't think it was malice. I think it's the same pattern I see everywhere: "we know what we're doing, it won't happen to us." Security becomes a checkbox instead of a living config. And then one Saturday afternoon, it does happen.

1. Emergency pausers work. Kelp's 46-minute response prevented another $100M loss. If you're building, invest in this infrastructure. Don't assume you'll never need it.

2. Composability is symmetric. When one LRT breaks, every lending market that touched it breaks with it. If your protocol integrates someone else's token, you own their risk too.

3. Wrapped tokens across N chains multiply your attack surface by N. Treat bridge reserves like the central reserves they actually are — because that's what they are.

I'm not panicking on my position, but I'm not adding either.

If you hold rsETH on an L2, assume the peg is under pressure until Kelp publishes their root cause analysis.

If you supplied WETH to Aave, keep an eye on the governance thread — that's where the bad debt conversation is going to happen, and Umbrella (Aave's new automated safety module) is about to get its first real test.

Bridges remain the weakest link in DeFi.

Ronin. Wormhole. Nomad. Multichain. Orbit. Now Kelp.

The failure mode is almost always the same: a verification assumption that turns out to be wrong, and a reserve sitting on the other side of it waiting to be drained.

The lesson for builders is the same one it always is. Configure for adversaries, not for the happy path. And when someone flags a security gap on a public forum, don't leave it sitting there for 15 months.

Talk next week,

Juan.