The memo
REJECTED. On 2026-04-18 an attacker forged a message to Kelp's LayerZero bridge and released ~116,500 rsETH — roughly 18% of circulating supply, ~$293M — with no ETH ever locked on the source side. The wallet had been funded through Tornado Cash ten hours earlier. Largest DeFi exploit of 2026, and the direct cause of ~$196M of bad debt at Aave. The failure was not in staking or restaking logic; it was a cross-chain bridge minting unbacked supply. That is the lesson worth carrying: for any wrapped or bridged asset, the bridge IS the asset's security model, and it is usually the least examined part of the stack. >95% was eventually recovered, which does not change the verdict.
What would reopen the file
- n/a — rejected
Facts on file
- Verdict
- Rejected
- Exposure
- ETH staking
- Chains examined
- Ethereum
- Memo version
- v1
- Reviewed
- Next review