A $290 million exploit struck the KelpDAO liquid restaking protocol through its LayerZero integration on April 18, freezing withdrawals and trading across connected DeFi markets, Galaxy reported.

The attack drained the protocol's wrapped-staked-ETH collateral and prompted KelpDAO to pause all minting, redemption and bridging functions. Galaxy's research team confirmed the exploit on-chain, showing the attacker siphoning funds across multiple networks before routing proceeds through mixing services.

What is at stake?

KelpDAO ranks among the largest liquid restaking protocols operating on Ethereum. Liquid restaking lets users re-pledge staked ETH to secure additional blockchain services, capturing yield across multiple networks simultaneously. The sector had grown to tens of billions of dollars in deposits industry-wide before the incident, according to Galaxy.

The liquid restaking category emerged in 2024 as a way for stakers to capture additional yield by re-pledging their staked ETH across multiple blockchain services. Deposits in the segment expanded rapidly in the 12 months preceding the incident, Galaxy noted.

KelpDAO's rsETH token had become one of the most widely integrated liquid restaking tokens across Ethereum's lending and trading venues prior to the attack. The protocol held billions of dollars in user deposits re-pledged as security for additional services.

How did LayerZero factor in?

LayerZero provides the cross-chain messaging infrastructure that KelpDAO and dozens of other protocols use to synchronize token supply across networks. The exploit targeted the cross-chain verification mechanism that connects KelpDAO's contracts to LayerZero-linked networks, according to Galaxy's analysis.

LayerZero Labs has positioned itself as a key infrastructure provider for omnichain applications. The protocol uses a configurable verification system in which applications select their own set of decentralized verification networks to confirm cross-chain messages.

Galaxy reported that LayerZero Labs was cooperating with KelpDAO and characterized the compromise as an implementation issue rather than a flaw in the underlying messaging layer. The incident ranks as the largest drain tied to a LayerZero-connected application to date, Galaxy noted.

What is the market fallout?

Trading in rsETH on major decentralized exchanges became one-sided within minutes of the exploit, with spreads widening as automated market makers pulled quotes. Lending markets that accepted rsETH as collateral disabled the asset to prevent liquidations triggered by unbacked tokens.

The freeze propagated through LayerZero-connected applications that do not directly involve KelpDAO, with several bridge aggregators and cross-chain swap protocols reporting elevated monitoring of their own verification stacks. Galaxy's analysts warned that the incident had touched multiple downstream protocols within hours of the attack.

What happens next?

The incident will likely accelerate adoption of multi-verifier configurations on LayerZero, requiring independent confirmation of cross-chain messages from multiple networks rather than a single provider. Galaxy's analysts urged protocols to adopt redundant verification stacks in the wake of the attack.

KelpDAO said it would publish a post-mortem and coordinate with blockchain analytics firms to trace the funds, according to Galaxy. The protocol's response will set precedent for how the broader restaking sector handles exploit recovery and verifier hardening going forward.

The next several days will determine whether remaining rsETH holders face losses or are made whole through protocol reserves. The wider DeFi industry will reassess how protocols select and monitor verification providers following the incident, Galaxy analysts wrote.