The Kelp DAO rsETH Exploit: A Post-Mortem on Cross-Chain Message Forgery

1. Incident Reconstruction

OnApril 19, 2026, Kelp DAO fell victim to a sophisticated exploit resulting in a catastrophic loss of$293 million. The attack targeted the trust relationship between Kelp’s bridge and the LayerZero messaging protocol.

• The Forgery:The attacker injected a malicious data packet into LayerZero’s cross-chain messaging contract, falsely claiming that a user on a remote chain had burnedrsETHto bridge it back to the Ethereum Mainnet.
• The Phantom Mint:In reality, no such deposit existed on the source chain. However, the forged message bypassed validation, tricking the bridge into releasing116,500 rsETH—approximately18%of the total circulating supply.
• The Siphon:Within minutes, the attacker deposited this "phantom" rsETH intoAaveas collateral. Leveraging the protocol's high Loan-to-Value (LTV) ratios, they borrowed$236 million in wETH.
• The Duration:The entire exploit unfolded in just46 minutes, ending only when Kelp’s emergency multi-sig triggered a global pause.

1. Technical Attack Vectors

The exploit succeeded through a lethal combination of message forgery and the exploitation of DeFi's interconnected nature.

• Cross-Chain Message Forgery:The attacker bypassed LayerZero's validation—potentially through a compromised private key or a flaw in signature construction—to craft a payload that appeared legitimate to the destination bridge.
• Oracle Trust Exploitation:Protocols integrated with rsETH relied on the bridge's integrity. When the forged assets were minted, oracles treated them as authentic, causing "cross-protocol contagion" that forced nine major DeFi platforms into emergency shutdowns.
• Rapid Arbitrage via Composability:By using Aave as a "liquidity exit," the attacker converted unbacked, forged tokens into hard assets (wETH) before the market or the Kelp team could react.

1. Deep Dive: Smart Contract Vulnerabilities

This incident highlights three classic technical failure points in signature verification:

1. The ecrecover Zero-Address Trap

In Solidity, the ecrecover function is used to verify ECDSA signatures.

• The Flaw:If the signature parameters $(v, r, s)$ are invalid, ecrecover does not revert; instead, it returns address(0).
• The Attack:If a contract fails to include require(signer != address(0)), and certain permissions are accidentally assigned to the zero address, an attacker can provide "garbage" data to produce a "valid" signature.

  1. Replay Attacks: Missing Nonces and Chain IDs

• Missing Nonces:Without a unique, incrementing nonce, an attacker can intercept a legitimate cross-chain message and re-submit it multiple times on the same chain.
• Domain Separator Issues:If a signature lacks a chainId, a withdrawal signed for Chain A can be "replayed" on Chain B, effectively doubling the payout.

  1. ECDSA Signature Malleability

  For any valid Ethereum signature $(r, s, v)$, there exists a second valid signature:

If a contract uses the raw signature hash to prevent replays, an attacker can slightly modify the $s$ value to create a different hash that represents the same valid signature, bypassing the "already used" filter.

1. Strengthening the Defensive Perimeter (Aave & DeFi)

To prevent "phantom assets" from draining liquidity pools, protocols like Aave must implement more aggressive risk parameters:

• Strict Supply Caps:Assets with lower liquidity or higher bridge risk (like LRTs) should never have uncapped deposits. Caps should be pegged to24-hour non-slippage depthon major DEXs.
• Isolation Mode:New or high-risk assets must be forced into Isolation Mode, where they can only borrow specific stablecoins and cannot be used alongside other collateral.
• Dynamic Debt Ceilings:Protocols should implement a debt ceiling for cross-chain derivatives that is dynamically linked to theActual Locked Value (TVL)on the source chain.
• Oracle Guardrails & Circuit Breakers:
• De-peg Triggers:If the price of rsETH deviates significantly from its underlying ETH value, the protocol should automatically freeze borrowing.
• Time-Delay for Large Deposits:Introduce a "observation window" for large collateral deposits, giving multi-sig teams time to respond to anomalies.

  1. Security Insights and Best Practices

1. References

• DeFi Losses Hit $600M in a Single Month: 2026 Becomes the Year of Exploits:[Source Link]
• SoK: Security of Cross-chain Bridges: Attack Surfaces, Defenses, and Open Problems:[arXiv:2312.12573]

Insight Report Source: Global Cybersecurity Alliancehttps://www.gcsa.org