The $300 million breach of KelpDAO appears to target Layer 2 pathways.
KelpDAO suffered a $300 million loss that originated on a Layer 2 bridge, not the Ethereum mainnet. An attacker waited ten hours after funding a wallet through Tornado Cash, then triggered LayerZero’s EndpointV2 to release 116,500 rsETH, about 18% of its supply. Two additional attempts to steal 40,000 rsETH each were halted when KelpDAO’s multisig paused the bridge, preventing a potential $391 million total loss. The stolen rsETH was deposited into Aave V3 as collateral, enabling large ETH and WETH loans that were routed back through Tornado Cash. Aave froze all rsETH markets on V3 and V4, citing a flaw in rsETH, while SparkLend, Fluid, Upshift, and other protocols paused related vaults. Exposure extended to products on Pendle, Compound, Euler, Beefy, and Yearn, though L1 rsETH remains fully backed and solvent. Investigators linked the breach to a single‑validator (DVN) setup on the Kelp rsETH Unichain‑Ethereum route, which allowed unbacked tokens to be minted on Ethereum. Competing LayerZero OFT bridges use a minimum 2/2 DVN configuration and rate limits, prompting them to pause all OFT bridges as a precaution. The issue is confined to the L2 bridge, limiting broader contagion risk. Withdrawals are technically possible but stalled pending clearer pricing for rsETH; Aave’s borrow rates have spiked and the Ethereum exit queue is clogged. Protocols expect additional liquidity by early next week to facilitate larger withdrawals, while losses could affect up to 6.2% of top‑level depositors if L1 backstops are needed. Separately, Vercel disclosed a breach exposing customer data and code for sale.
