POPA ReconInside KelpDAO rsETH Exploit: $292M Minted From a Bridge
Inside KelpDAO rsETH Exploit: $292M Minted From a Bridge On April 18, 2026 at 17:35 UTC, an attacker exploited KelpDAO's LayerZero OFT bridge by forging a single cross-chain message, possible because the adapter was configured with just 1-of-1 DVN (one validator signature required). This released 116,500 rsETH ( ~$292M) from mainnet escrow to an attacker-controlled address. No restaking contracts were broken. The failure was entirely in the bridge configuration. The attacker immediately deployed the stolen rsETH as collateral across Aave V3/V4 (Ethereum + Arbitrum), Compound V3, and Euler —…
The excerpt is quoted from a public Telegram channel, which owns its text.