Kelp DAO Suffers $292 Million Attack, Aave and Other Protocols Face Structural Bad Debt Risk

BroadChain has learned that at 14:16 on April 19, according to PANews, in the early hours of April 19, the rsETH cross-chain bridge of Kelp DAO, a product under Kernel DAO, based on LayerZero was attacked. The attacker stole approximately 116,500 rsETH, valued at about $292 million, accounting for 18% of its circulating supply, from the mainnet OFTAdapter contract by forging cross-chain messages. The attacker subsequently used the stolen rsETH as collateral to deposit into lending protocols such as Aave and Compound, borrowing over $236 million worth of ETH, with Aave alone incurring approximately $196 million in debt. As the mainnet reserves backing the collateral rsETH have been drained, its value has dropped to zero, exposing protocols like Aave to the risk of structural bad debt that cannot be covered through liquidation. This attack highlights the vulnerability of the LayerZero OFT cross-chain architecture under weak security configurations using a single DVN (Decentralized Verifier Network), as well as the systemic risks arising from the over-composability and over-collateralization of Liquid Restaking Tokens (LRT) within the DeFi stack. Following the incident, at least nine related protocols triggered emergency responses, suspending or freezing relevant markets.