$293M Exploit on KelpDAO-Cyvers Flags Massive Breach in Real-Time

On-Chain Media confirms that Kelp DAO has suffered a major exploit, with approximately $293.7 million drained from its rsETH Adapter / bridge contract.

Cyvers’ AI-powered monitoring systems flagged the breach in real time, tracking the attack from its earliest stages. According to Cyvers Alert, roughly $250M has already been swapped into $ETH and is now distributed across two chains: 

Ethereum: ~$178M

  
Arbitrum: ~$72M 

What Happened

The attacker exploited Kelp DAO’s bridge contract, enabling the withdrawal of roughly 116.5K ETH worth of $rsETH. The exploiter then rapidly converted and leveraged the stolen assets:

• Approximately $250M has already been swapped into $ETH.

• Funds are currently held across Ethereum and Arbitrum chains.

• Stolen rsETH was deposited as collateral into lending protocols including Aave V3, Compound V3, and Euler 
   

• The attacker borrowed large amounts of $WETH, generating over $236M in debt 

This turned a single-protocol exploit into a fast-moving cross-protocol contagion.

Protocols Affected

At least 9 protocols have taken emergency measures:

• Aave V3 and SparkLend froze rsETH-related markets and exposure 

• Fluid, Compound, Euler, Upshift, Pendle (PT/YT tokens), and multiple vault strategies were impacted 

On-Chain Intelligence

Attacker Address: 

0x8B1b6c9A6DB1304000412dd21Ae6A70a82d60D3b

Cyvers’ reputation analysis links the attacker to Tornado Cash funding. Funds are being layered through intermediate wallets (0xbb6… and 0x1f4…) in an attempt to obscure the flow.

Kelp DAO Response

Kelp DAO identified suspicious cross-chain activity involving rsETH and has paused contracts across mainnet and several L2s. The team is working with LayerZero, Unichain, auditors, and security experts on root cause analysis.

Why This Matters

The incident underscores the systemic risks of DeFi composability. When a liquid restaking token like rsETH is deeply integrated across lending markets, vaults, and liquidity protocols, a breach in one layer can cascade rapidly — creating bad debt and forcing widespread market freezes.

“This is exactly the kind of incident that highlights the risks of composability in DeFi. The challenge is no longer just preventing exploits at the contract level, but understanding how fast they can cascade across integrated protocols. Real-time monitoring is the only way to detect, respond, and contain these events before they turn systemic.” — Deddy Lavid, CEO & Co-founder, Cyvers