Perry The Platypus

KelpDAO $rsETH Exploit stands out as arguably the largest DeFi exploit in Q2 2026 so far, with 116,500 @rsETH minted without backing worth roughly $292–293.7M at the time. What makes this case particularly important is that the root cause was not a flaw in KelpDAO’s smart contracts, but a weakness in the security configuration of the @LayerZero_Core V2 OApp stack. A 1-of-1 DVN setup, combined with a compromised or spoofed validator, allowed the attacker to forge a cross-chain message and invoke lzReceive to mint $rsETH without any real backing. With the unbacked $rsETH in hand, the attacker moved quickly, using it as collateral across @aave V3, Compound V3, and Euler to borrow real $WETH/ETH. This ultimately left behind $200M+ in bad debt, spreading systemic risk across multiple lending protocols. The incident highlights a major shift in DeFi risk, where vulnerabilities are no longer limited to on-chain smart contracts. Configuration choices, message verification layers, DVNs, oracles, and off-chain infrastructure are increasingly becoming the weakest links in protocol design. A misconfigured security stack alone can be just as catastrophic as a full smart contract exploit.