$292 Million rsETH Bridge Exploit Triggers DeFi Market Freeze, Aave Halts Activity

Kelp DAO’s LayerZero-based rsETH bridge has been hit by what appears to be a major exploit, with early estimates pointing to losses of roughly 116,500 rsETH—about $292 million—an incident that quickly rippled through DeFi lending markets and sparked fresh concerns about cross-chain security.

Kelp DAO said it identified suspicious cross-chain activity tied to rsETH and moved to halt rsETH contracts across mainnet and multiple layer-2 networks. The protocol added that it is working with security specialists to investigate the incident and will publish further details as the review progresses.

The episode immediately drew a defensive response from major money markets. Aave (AAVE) said it has frozen rsETH markets on Aave V3 and V4 and disabled borrowing for the asset while it assesses the situation. Aave emphasized it does not directly hold rsETH and that the issue is not related to Aave’s own smart contracts, but rather to a vulnerability in Kelp DAO’s rsETH bridging mechanism. The platform said it is reviewing rsETH borrows inside the protocol to gauge potential bad debt and identify steps to limit losses before sharing additional updates.

Market participants also focused on potential second-order impacts from a liquid staking token shock. Spark Protocol’s strategy lead, monetsupply.eth, warned on X that the rsETH security incident could become more destabilizing if it collides with shrinking stablecoin liquidity. He estimated that around 16.5% of the ETH market is supported by rsETH-related demand and positioning, and argued that if losses are reflected unevenly across mainnet and cross-chain environments, rsETH collateral in DeFi ‘eMode’ setups could trade at a 10% to 15% discount. If risk buffers are exhausted, he added, ETH depositors could still face residual losses in the 2% to 3% range.

In that scenario, monetsupply.eth said, depositors may rush to withdraw funds, pushing utilization to 100%—a ‘lock-up’ condition that can impair normal interest-rate incentives and slow self-correction. He also warned that borrowers who used ETH as collateral to borrow stablecoins such as USDT could struggle to unwind positions if ETH withdrawals become constrained, weakening the system’s usual balancing mechanism even as stablecoin borrow rates rise. If a lock-up persists, he argued, cascading liquidations can emerge as collateral health becomes harder to actively manage and liquidators face practical barriers to withdrawing and selling seized collateral.

On-chain monitoring added fuel to the volatility. PANews, citing Ember tracking, reported signs that illicitly minted rsETH may have been deposited as collateral to borrow large amounts of ETH, followed by whale-driven selling pressure in Aave (AAVE) that coincided with a roughly 15% drop in AAVE’s price. The report highlighted several large sell transactions, including a Polymarket user known as ‘smaugvision’ selling 20,015 AAVE at about $102.90, alongside other addresses selling tens of thousands of AAVE in the $99 to $103 range. While the claims remain based on on-chain observations, traders are watching for further knock-on effects across lending pools and liquid staking derivatives.

Precautionary actions spread beyond Kelp DAO. etherFi said it temporarily paused its LayerZero cross-chain bridges for weETH and eETH until the root cause of the rsETH incident is confirmed. The team noted its Liquid vaults are not directly exposed to the rsETH event, but said it has halted certain Teller contracts tied to products including Liquid (ETH, BTC, USD), sETHFI, and eBTC to block LayerZero OFT bridge routes, pausing related deposits and withdrawals while it reviews conditions with security partners.

Separately, geopolitical developments added to broader risk sensitivity. Shipping traffic through the Strait of Hormuz was reportedly halted again on Friday UTC, according to British-linked information cited by local reports, amid claims that Iranian forces reasserted strict control measures via radio warnings. UK maritime security firm Ambrey also reported indications of attacks involving three vessels near the area, including a tanker and a cruise ship that were allegedly fired upon following warnings, and a container ship hit by an unidentified projectile northeast of Oman. Iran’s foreign ministry, meanwhile, was quoted as saying ‘unconditional’ passage through the strait can no longer be guaranteed, arguing that conditions changed after U.S. forces entered nearby waters following U.S. and Israeli strikes. As a critical artery for global oil flows, disruptions in the strait can pressure energy markets and often feed through to volatility in ‘risk assets’ such as Bitcoin (BTC) and Ethereum (ETH).

In other developments, Russia’s central bank is reportedly considering restricting retail investors’ access to crypto derivatives, according to TASS—another signal of a tightening stance on high-risk crypto exposures. In the U.S., Charles Schwab ($SCHW) and Citadel Securities are evaluating a potential move into prediction markets, with Schwab CEO Rick Wurster saying on an earnings call that launching such a product is increasingly likely and operationally feasible, while Citadel Securities’ leadership indicated it is monitoring liquidity conditions and may participate as the market matures.

Traders also tracked a notable on-chain move involving Tron founder Justin Sun. PANews, citing on-chain analyst Ai Yi, reported that Sun withdrew 53,665 ETH—about $126 million—from Aave roughly five hours earlier and has so far kept it in a wallet without further transfers. While no exchange deposit or sale has been confirmed, the size of the withdrawal drew attention amid heightened sensitivity around lending liquidity and collateral flows.

For now, the rsETH incident is shaping up as a stress test for cross-chain infrastructure and the interconnected DeFi credit stack, with market participants watching whether containment measures—market freezes, bridge pauses, and collateral controls—can prevent a broader liquidity squeeze.