The $292 Million Forgery That
Triggered a $13 Billion Bank Run

On 19 April 2026, a single forged message crossed a cross-chain bridge. It was a LayerZero message — one of the standard packets that DeFi protocols use to communicate across blockchain networks. The message said, in effect: a deposit has been made. Please mint the corresponding tokens. No deposit had been made. The tokens were minted anyway.

What followed from that single forged packet was one of the most technically sophisticated cascading exploits in DeFi history. $292 million in rsETH — KelpDAO's restaked ETH token — was minted without any backing collateral. The attacker immediately used this unbacked rsETH as collateral in Aave, one of the largest decentralised lending protocols in the world. They borrowed real assets against fake collateral, withdrew them, and began routing everything through Tornado Cash. By the time KelpDAO's on-chain monitoring detected the anomaly, the attacker had been gone for nearly two hours.

The theft itself was devastating enough. But the second-order effect — what happened to the legitimate users of Aave when the rsETH price collapsed — is what elevated this from a hack into a systemic crisis.

KelpDAO and the Architecture of Restaking

To understand how this attack worked, you need to understand what KelpDAO does and why it had hundreds of millions of dollars of value resting on a cross-chain bridge verification system.

KelpDAO is a liquid restaking protocol built on EigenLayer. When users deposit ETH or liquid staking tokens (like stETH), KelpDAO gives them rsETH — a liquid receipt token representing their restaked position. rsETH can then be used across DeFi: as collateral in lending protocols, as liquidity in automated market makers, or bridged to other chains where yields may be higher. By April 2026, KelpDAO had approximately $1.6 billion in total value locked, with rsETH deployed across 20 different blockchain networks via LayerZero's cross-chain messaging infrastructure.

The value of rsETH across all those chains was backed by a simple guarantee: every rsETH token in existence corresponds to real ETH or staking assets deposited on Ethereum mainnet. The LayerZero bridge was the mechanism by which the protocol verified cross-chain deposits and authorised the minting of new rsETH tokens. That verification mechanism had a flaw that the attacker had spent months identifying.

How the Exploit Worked

Step 1 — Finding the Verification Gap

LayerZero's cross-chain messaging protocol works by transmitting packets between chains and verifying them through a combination of on-chain and off-chain oracle infrastructure. KelpDAO's bridge integration verified incoming messages from other chains to authorise rsETH minting on Ethereum mainnet. The attacker identified that the message verification logic had an edge case: under specific network conditions, a message that appeared to originate from a valid KelpDAO deployment on an alternate chain could pass verification without the corresponding on-chain state being checked against an independent source.

Step 2 — The Forged Message

The attacker crafted a LayerZero message asserting that a deposit of approximately 97,000 ETH worth of staking assets had occurred on an alternate-chain KelpDAO deployment. The message passed the bridge contract's verification check. KelpDAO's mainnet contract minted 97,340 rsETH — tokens representing a claim on real ETH that did not exist. At the market price of rsETH at time of exploit, this represented approximately $292 million in newly created, entirely unbacked tokens.

Every one of those tokens crossed the Ethereum mempool — visible, anomalous, and unexamined — before being included in a block and becoming permanent on-chain reality.

Step 3 — The Collateral Gambit

Most exploiters take their stolen tokens and run. The attacker here did something more sophisticated. Rather than immediately swapping the rsETH for ETH or stablecoins — which would have crashed the rsETH price immediately and signalled the exploit — they deposited the unbacked rsETH into Aave's rsETH lending market as collateral.

Aave accepted it. The market price of rsETH had not yet moved. The protocol saw valid rsETH tokens and issued borrowing capacity against them. The attacker immediately drew down approximately $238 million in ETH and USDC against the fake collateral. This is the borrowed value they actually walked away with. The remaining rsETH position was left in Aave as collateral that would soon be worth nothing.

Step 4 — The Tornado Cash Run

Within 90 minutes of the initial minting, the attacker had converted most of the borrowed ETH and USDC through multiple hops toward Tornado Cash. The path: flash-swapped USDC to ETH via Uniswap, split across 14 fresh wallets, and routed through Tornado Cash in chunks designed to avoid detection thresholds. The stolen funds were effectively mixed before any exchange had listed the relevant wallet addresses on their sanctions screening lists.

The entire stolen ETH crossed the mempool before any post-broadcast tool could act. Chainalysis, TRM Labs, and on-chain trackers like ZachXBT identified the exploit within two hours — but by then, the trail was already fragmented across Tornado Cash pools.

The $13 Billion Aave Bank Run

This is the part of the KelpDAO exploit that most post-mortems underweight. The theft of $292 million was large. The cascade it triggered was catastrophic.

When the exploit became public knowledge — through on-chain analytics, social media, and KelpDAO's own emergency announcement — rsETH's market price began to fall rapidly. Every DeFi participant who held rsETH as collateral in Aave now faced the same calculation: their collateral was declining in value, and if it fell below their liquidation threshold, their positions would be automatically closed.

The rush to withdraw rsETH collateral and repay Aave loans triggered a cascade of liquidations. Liquidation bots, which automatically purchase discounted collateral in exchange for repaying borrower debt, began firing at scale. The forced selling of rsETH further depressed the price, triggering more liquidations. Within 6 hours of the exploit becoming public, Aave's rsETH market experienced approximately $13 billion in gross outflows — a combination of voluntary withdrawals by frightened lenders and forced liquidations of borrowers whose collateral values had collapsed.

The bank run was not caused by a protocol flaw in Aave. Aave's code worked exactly as designed. The problem was that the collateral it had accepted — rsETH — had been fundamentally compromised by an upstream exploit in KelpDAO's bridge architecture. This is DeFi composability risk in its most acute form: a vulnerability in one protocol propagates instantaneously through every protocol that holds its token as collateral.

Who Was Victimized

KelpDAO Depositors

Users who had deposited real ETH or staking assets into KelpDAO found their rsETH tokens depegged and temporarily illiquid. KelpDAO paused its bridge immediately upon discovery of the exploit, meaning holders of rsETH on alternate chains could not bridge back to mainnet for several weeks while the protocol assessed total losses and began rebuilding its bridge verification architecture. Some users — particularly those who had deposited on lower-liquidity chains — faced extended lock-up periods.

Aave Lenders

Legitimate Aave lenders who had supplied ETH or USDC to the rsETH lending market found themselves unable to withdraw during the peak congestion period. The protocol's liquidity pools were being simultaneously drained by the attacker's borrowing and by the wave of panic withdrawals from other users. For several hours, withdrawal queues backed up significantly. Most lenders were eventually able to exit, but at the cost of days of elevated anxiety and, for some, at suboptimal prices.

Aave Borrowers

Any Aave borrower who had used rsETH as collateral — not just the attacker — faced liquidation risk as the rsETH price fell. Thousands of legitimate borrowers had their positions liquidated, paying liquidation penalties and losing access to their collateral at a time when the market was moving against them. These losses were real, uncompensated, and entirely caused by the upstream exploit.

What Went Wrong — And at Whose Door

KelpDAO: Bridge Verification Architecture

The root failure was in KelpDAO's decision to trust LayerZero message payloads as the sole authoritative source for deposit confirmation on cross-chain minting. A dual-verification system — where an independent oracle or state proof confirmed the source-chain deposit before allowing destination-chain minting — would have made this specific exploit impossible. This is a known design pattern in cross-chain bridge security. It was not implemented.

Aave: Concentration Risk

Aave's protocol functioned correctly. But the risk management parameters that allowed a single collateral type to represent such a large fraction of total protocol exposure — and the absence of automated circuit breakers that would have paused rsETH markets on detection of anomalous minting volumes — represent a governance failure. When a new token type is accepted as collateral in a major lending protocol, the bridge architecture underlying that token becomes a systemic risk vector for the entire protocol.

The Industry: Cross-Chain Composability Debt

The deeper problem is structural. Every cross-chain bridge creates a trust assumption. Every token that crosses that bridge carries a version of that assumption into every protocol that accepts it. When KelpDAO's rsETH became collateral in Aave, Aave implicitly inherited a dependency on KelpDAO's bridge security. Neither protocol's documentation made this risk explicit to users. The industry's collective failure to audit and price cross-chain trust assumptions remains one of the most underacknowledged systemic risks in DeFi.

Attack Timeline

Outcomes and What the Industry Must Now Reckon With

The KelpDAO exploit produced a specific regulatory response that is worth noting: within two weeks of the attack, the EU's European Banking Authority issued a formal consultation on cross-chain bridge security standards for MiCA-regulated entities. The FATF added bridge protocol due diligence to its updated VASP guidance. The Bank Policy Institute published research estimating that each dollar stolen in a DeFi protocol exploit produces approximately $20 in follow-on protocol outflows — the $292M exploit triggered roughly $5.8B in economic damage beyond the direct theft.

Within the DeFi industry, a wave of bridge security audits began. Aave governance significantly tightened collateral eligibility requirements for bridge-backed liquid staking tokens. Several protocols that had planned rsETH integrations paused development. These are the right responses. They do not address the timing problem that made this attack possible in the first place.

The forged bridge message executed on 19 April 2026 at 03:17 UTC crossed the Ethereum mempool before it was confirmed. It had a distinctive anomaly signature — a minting event with no corresponding source-chain deposit state. In those seconds, every piece of information needed to identify and refuse this transaction was available to a system positioned at the right place in the transaction lifecycle. The industry did not have such a system deployed.