Kelp Says April 18 rsETH Incident Stemmed From LayerZero Infrastructure Breach
Kelp has attributed the April 18 rsETH incident to a breach in LayerZero’s cross-chain messaging infrastructure, shifting responsibility for the exploit away from its own protocol stack and toward a third-party dependency used to bridge the liquid restaking token. The incident affected approximately $290 million in rsETH bridged assets.
What Kelp claimed about the LayerZero infrastructure failure
Kelp’s account, detailed in a post on LayerZero’s blog, pointed to infrastructure-level defaults rather than a flaw in rsETH’s token logic or restaking contracts. The distinction matters: if accurate, the root cause sat in the messaging layer that connects chains, not in Kelp’s core Ethereum ETH +0.00% staking product.
The incident occurred on April 18. According to reporting from Crypto.news, Kelp blamed LayerZero’s default bridge configuration for the approximately $290 million rsETH bridge disaster.
An incident report was subsequently posted to Aave’s governance forum on April 20, suggesting the exploit had downstream effects on DeFi protocols that accepted rsETH as collateral.
Hypernative, a blockchain security firm, also published a post-mortem analysis of the exploit, providing additional third-party review of the incident mechanics.
How the breach affects rsETH holders and Ethereum risk perception
The incident highlights a structural risk in Ethereum liquid restaking: tokens like rsETH rely on cross-chain bridges to reach users on Layer 2 networks and alternative chains. When those bridges depend on third-party messaging protocols, a single infrastructure failure can affect assets across multiple deployments.
For rsETH holders, Kelp’s attribution to LayerZero raises questions about which party bears responsibility for securing bridged assets. Protocol design risk, where a bug exists in the token’s own smart contracts, differs fundamentally from vendor risk, where a trusted external service introduces the vulnerability.
Users holding rsETH on chains other than Ethereum mainnet faced the most direct exposure during the April 18 event. The Aave governance discussion suggests that lending markets integrated with rsETH needed to reassess their risk parameters following the breach. As institutional inflows continue fueling rallies across digital assets, the security of underlying DeFi infrastructure becomes increasingly material to broader market confidence.
Why this incident matters beyond Kelp
Any Ethereum restaking protocol that uses cross-chain messaging to distribute its tokens carries similar infrastructure dependency risk. The security of a bridged restaking token is only as strong as the weakest link in its delivery chain.
The distinction between protocol risk and infrastructure risk will likely shape how DeFi lending platforms evaluate liquid restaking tokens as collateral going forward. Projects that rely on default bridge configurations without custom security settings may face increased scrutiny from integrators. Entities like Capital B, which recently expanded its holdings to 2,937 BTC, illustrate the scale of institutional capital now exposed to the broader digital asset ecosystem’s infrastructure decisions.
For individual participants evaluating restaking opportunities, the lesson is operational: auditing a protocol’s own contracts is necessary but insufficient. The full dependency stack, including messaging layers, oracle providers, and bridge implementations, determines actual security. Projects across the multi-chain crypto landscape will need to address these vendor dependencies transparently.
Disclaimer: This article is for informational purposes only and does not constitute financial or investment advice. Cryptocurrency and digital asset markets carry significant risk. Always do your own research before making decisions.
