Hackers target DeFi protocol Kelp DAO in massive $300m exploit

Another day, another DeFi hack.

That’s what appears to be the case after blockchain security experts on Saturday flagged nearly $300 million leaving Ethereum-based Kelp DAO.

First alerted by blockchain sleuth ZachXBT via his Telegram channel, a total of $293.7 million was drained from the protocol’s rsETH Adapter — a tool allowing users to deposit liquid staking tokens and get rsETH in return.

Kelp DAO wrote on X that it had “identified suspicious cross-chain activity involving rsETH” and that it had paused rsETH contracts while it investigated the situation with security experts.

The world’s biggest DeFi project, Aave, also posted on X that it had frozen rsETH markets on its peer-to-peer lending protocols Aave 3 and Aave 4.

“Aave’s contracts have not been exploited and this is an exploit related to rsETH,” the project’s official account wrote.

Security firm Cyvers confirmed the hack to DL News, and said the funds had been swapped back to Ethereum and Arbitrum. It added that the attacker was linked to coin-mixer Tornado Cash’s funding.

Kelp DAO did not immediately respond to questions from DL News.

This is a breaking news story and will be updated.

Mathew Di Salvo is a news correspondent with DL News. Got a tip? Email at mdisalvo@dlnews.com.