A massive $292 million exploit of the KelpDAO rsETH cross-chain bridge has triggered a severe liquidity crisis across the decentralized finance (DeFi) sector, leading to an estimated $10 billion capital outflow over the weekend. The incident, now the largest DeFi exploit of 2026, has caused contagion that spread from Ethereum to the Solana blockchain, devastating the USDC liquidity pools of automated market maker Kamino Finance.
The attack began late Saturday when an attacker drained approximately 116,500 rsETH from KelpDAO's bridge. The stolen tokens, worth $292 million at the time, were moved through Tornado Cash to obscure the trail. The exploit occurred on the route linking Unichain to Ethereum via LayerZero, where a fraudulent message was accepted as valid, prompting the release of pre-funded rsETH reserves. KelpDAO's emergency multisig wallet subsequently froze core contracts, blocking two further attempts that could have removed another $100 million.
The most severe immediate aftershock hit Aave, the largest crypto lending platform, where the attacker allegedly deposited stolen rsETH as collateral. While Aave's oracles still read rsETH near its peg, the protocol issued 106,467 ETH against the compromised collateral, creating a potential $236 million bad-debt exposure. This triggered a massive user withdrawal, with Aave's Total Value Locked (TVL) plummeting from over $26 billion to about $20 billion. The platform's ETH utilization rate hit 100%, and its governance token AAVE fell more than 18%.
The contagion rapidly spread to Solana. Risk-off behavior and capital flight from Ethereum-based DeFi cascaded onto Solana, aggressively draining the USDC liquidity pools of Kamino Finance. Data from Wu Blockchain reveals critical stress levels: Kamino's Prime Market USDC pool, valued at $178 million, has reached 100% utilization, effectively locking all deposits. The Stakehouse USDC Vault and LockawayX RWA USDC Vault also show utilization rates above 95%.
The broader DeFi sector saw its total TVL drop roughly 10%, from around $99 billion on April 18 to $89 billion. In response to the crisis, multiple protocols, including Aave V3/V4, Lido, SparkLend, Fluid, Compound, and Euler, froze their rsETH lending markets. Ethena also temporarily suspended its LayerZero bridges as a precaution.
Industry experts are calling for systemic solutions. The event has sparked discussion on the need for rate limits on how quickly an asset can be deposited and used as collateral in pooled lending protocols, as well as custom throttles on cross-chain bridges to prevent similar catastrophic outflows in the future. The situation underscores the fragile interdependence and speed of contagion within the modern, multi-chain DeFi landscape.
