Journalism for the digital-asset economy
Best Liquid Restaking Protocols · Rank 08 of 8
Nobody yet — not until the rsETH backing is restored and the bridge design is replaced
Last verified August 18, 20264 scored axes
Adverse event on record
Kelp DAO scores 5.1 out of 10 and ranks #8 of 8 in the best liquid restaking protocols table, strongest on slashing exposure (5.5) and weakest on exit design (3.5).
Kelp's multi-asset design made rsETH easy to use, and its cross-chain adapter made it the largest DeFi loss of 2026: 116,500 unbacked rsETH minted on 18 April, roughly $292m, which then propagated into the lending markets that had accepted the token as collateral. The restaking contracts held; the bridge around them did not.
4 axes, weighted as published in the table’s methodology. Each score below is read from the fact printed under it.
5.5/ 35% of the score
On 18 April 2026 an attacker minted 116,500 unbacked rsETH — roughly $292m, about 18% of supply — by feeding a crafted message to the protocol's LayerZero cross-chain adapter, which ran a single-point verification setup. DPRK-linked actors were credited with it; the restaking contracts themselves were not breached.
5.5/ 25% of the score
Operator delegations remain visible on-chain, but the incident showed that cross-chain verification depended on infrastructure the documentation never surfaced as a single point of failure.
3.5/ 20% of the score
Redemption was overwhelmed by unbacked supply: the minted rsETH was posted as collateral on Aave and borrowed against, forcing liquidations and a liquidity squeeze across every market that had accepted the token.
5.5/ 20% of the score
Before the exploit, yield was staking rewards plus points; what a holder now has is a recovery claim rather than a yield position.
An attacker sent a crafted message to Kelp's LayerZero cross-chain adapter and minted 116,500 rsETH out of nothing — roughly $292m, about 18% of supply, and the largest DeFi loss of the year. DPRK-linked actors were credited with it. The restaking contracts were never breached; the verification configuration around the bridge was, and it turned out to be a single point of failure that no documentation had surfaced as one.
The minted rsETH was posted as collateral on Aave and borrowed against, which pushed between $177m and $236m of bad debt onto a lending protocol that had done nothing wrong except list the token. This is the clearest illustration the sector has produced that a wrapped asset carries its weakest link into every market that accepts it.
A published post-mortem naming the cause, operator delegations still visible on-chain, and a backing question that has to be resolved before the token means anything again. Redemption was overwhelmed by unbacked supply.
There is no case for a new deposit here until the backing is restored and the cross-chain design is replaced with something that does not depend on one verification path.
On 18 April 2026 an attacker exploited the protocol's LayerZero cross-chain adapter to mint 116,500 unbacked rsETH, worth roughly $292m. The restaking contracts themselves were not breached — the bridge verification around them was.
Not fully, following the April 2026 mint of unbacked supply. Restoring the backing is the open question that determines whether the token is investable again.
Because the unbacked rsETH was deposited as collateral on Aave and borrowed against, leaving that protocol carrying $177–236m of bad debt from an asset it had listed in good faith.
8 services in best liquid restaking protocols