Kelp $293M Exploit via Compromised Validator

Kelp lost $293M after a compromised cross-chain message validator allowed an attacker to drain 18% of token supply. The exploit bypassed smart contract audits entirely, highlighting infrastructure-level trust risks.

Heat

Confidence

95%

Evidence

Updated

2026-07-09 09:51 UTC

Why It Happened

The attacker compromised a validator responsible for cross-chain message verification, breaking the trust assumption that audits cannot cover. This enabled the theft of $293M without touching any smart contract code.

Outcome So Far

Funds stolen; community trust eroded; calls for velocity limits and better infrastructure security.

Actors

Kelp DAOSustainable yield from global trade and payments

Kelp DAO is a triple income restaking protocol based on EigenLayer. rsETH is a Liquid Restaked Token (LRT) issued by Kelp DAO designed to offer liquidity to illiquid assets deposited into restaking platforms, such as EigenLayer. Kelp DAO was founded by Amitej G and Dheeraj B.

ATAttackerexploiter

Timeline order

2026-06-22
Post

Parent event 01

X conversation update

1 related posts from @CertiKAlert

X conversation update

3 related posts from @secondfiapp, @Ucan_Coin, @SiCkBrAiNwAlKeR

Related posts@secondfiapp@Ucan_Coin@SiCkBrAiNwAlKeR

@secondfiapp2026-06-23 11:21 UTC

Open on X111.4K views · 289 likes · 83 reposts

@Ucan_Coin2026-06-23 11:18 UTC

Open on X9.7K views · 114 likes · 10 reposts

@SiCkBrAiNwAlKeR2026-06-23 15:59 UTC

Open on X7.9K views · 104 likes · 9 reposts

2026-06-23
Post

Parent event 03

Commentary on Kelp Exploit

Ucan_Coin notes that $292M left Kelp in one motion, questioning why no velocity limits prevented 18% of token supply from being moved unchecked.

X conversation update

1 related posts from @CertiKAlert

Kelp $293M Exploit Reported

Kelp lost $293M due to a compromised cross-chain message validator. The exploit did not touch smart contract code, bypassing audits.