Lido Reports 9% rsETH Exposure After KelpDAO Exploit

TLDR

• Lido confirmed that its EarnETH vault has about 9% direct exposure to rsETH after the KelpDAO exploit.
• Lido paused EarnETH deposits and withdrawals while curators work through the fallout.
• The protocol stated that stETH and wstETH remain unaffected by the incident.
• The KelpDAO exploit involved 116500 rsETH valued at around $292 million at the time.
• Aave froze rsETH and wrsETH markets across deployments following the exploit.

Lido confirmed that its EarnETH vault holds about 9% direct exposure to rsETH after the KelpDAO exploit. The protocol paused deposits and withdrawals while curators address the fallout. It also stated that its core staking system, including stETH and wstETH, remains unaffected.

Lido Details EarnETH Exposure and Safeguards

Lido said its EarnETH vault carries roughly 9% direct exposure to rsETH following the April 18 exploit. The team paused deposits and withdrawals while curators assessed the situation. However, Lido confirmed that stETH and wstETH remain untouched and operational.

The exploit targeted KelpDAO when an attacker forged a cross-chain message. The attacker released 116,500 rsETH without a burn on the source chain. That amount was valued at nearly $292 million and equaled about 18% of circulating rsETH.

As a result, lending platforms froze rsETH markets to limit further damage. Aave stated that its guardian froze rsETH and wrsETH markets across deployments on April 18. Consequently, several staking loop strategies faced pressure from liquidity constraints.

Lido said the issue extends beyond direct rsETH exposure within EarnETH. Contributors are addressing elevated borrowing costs and tighter liquidity in lending markets. Veda and Mellow have reduced leverage and cut wETH debt in affected strategies.

Lido also said EarnETH holds other positions independent of rsETH. The team reported that rapid deleveraging placed the vault in a stronger position. However, it continues to evaluate potential losses tied to the exploit.

Recovery Steps and Broader Market Response

Lido outlined a $3 million first-loss protection mechanism funded by the Lido DAO treasury. The DAO will burn its vault shares to absorb any realized loss. This measure will activate if EarnETH records an actual deficit.

The protocol also mentioned a possible last-resort withdrawal path. Curators may allow early exits with a maximum anticipated haircut. Lido said it would use this option only if remediation takes longer than expected.

The broader stress began when the attacker moved the illicit rsETH into lending venues. The attacker then borrowed ETH against the tokens, which strained liquidity. Risk managers responded by freezing rsETH markets to contain exposure.

Products tied to looped staking strategies felt the impact across protocols. Lido stated that its DVV and EarnUSD vaults have no exposure to rsETH issues. However, the GGV subvault holds looped staking positions and currently posts negative yields.

Lido said users who submitted GGV withdrawal requests before the incident will receive pre-incident valuations. This policy applies to requests made before the market disruption. The protocol continues to provide updates on loss allocation and recovery progress.

Arbitrum’s Security Council froze about 30,766 ETH linked to the exploit. The frozen amount carries an estimated value of $71 million. Lido said recovery efforts remain active while public updates continue to develop.