EigenLayer: The $22B Restaking Boom That the Kelp DAO Hack Finished Off

At 17:35 UTC on Saturday 18 April 2026, a bridge belonging to Kelp DAO released 116,500 rsETH tokens to a stranger, on the strength of a message saying they had been destroyed on another network. They had not. The tokens were worth about $292 million and made up 18% of all rsETH in existence. Within a week depositors had pulled more than $10 billion out of Aave, the biggest crypto lending market, and the idea that had pulled tens of billions into "liquid restaking" was finished.

Liquid restaking was sold as a way to earn three incomes from one deposit. It had already been losing money and believers for a year. The Kelp DAO theft showed the risk nobody had priced in.

The pitch: one deposit, three incomes

It starts with ether (ETH), the currency of the Ethereum network. Ethereum pays holders to lock up their ether and help run the network, which is called staking. It pays about 3% a year, like a fixed-term deposit.

In 2023 a project called EigenLayer, founded by Sreeram Kannan, offered a second layer. Staked ether could be pledged again, restaked, as a security deposit for other services built on Ethereum, in return for extra rewards. If those services were cheated, part of the deposit could be confiscated, a penalty called slashing. The closest comparison is using one house as collateral for two loans.

The third layer was "liquid" restaking. Firms such as Kelp DAO, ether.fi and Renzo took customers' ether, staked and restaked it, and handed back a receipt token: rsETH from Kelp, weETH from ether.fi, ezETH from Renzo. These receipts are called LRTs, liquid restaking tokens. They worked like fund units: they could be sold, or pledged at Aave as collateral to borrow dollars, which could buy more ether to restake again. Each layer looked only slightly riskier than the one below it. Stacked together, users were told, the returns could reach double digits.

Points, not money

Much of the promised reward was not paid in cash. EigenLayer and the LRT firms paid "points", loyalty-scheme credits that might one day turn into tokens of unknown value. Customers were piling in for an airline-miles scheme with no published exchange rate.

EigenLayer's deposits went from about $1.3 billion at the end of 2023 to $20.1 billion in June 2024, according to DefiLlama, which tracks these figures. The cracks showed early. On 24 April 2024, when Renzo published how its points would convert, holders rushed to sell ezETH, and on the trading app Uniswap it briefly fell to $688 against ether's price of more than $3,000, according to The Block. People who had borrowed against ezETH were forcibly sold out.

EigenLayer's own token, EIGEN, started trading in the autumn of 2024 and peaked at $5.65 in December. Slashing, the penalty that was supposed to give restaking its purpose, did not go live until 17 April 2025. EigenLayer's deposits peaked at about $22.1 billion on 14 August 2025, helped by a high ether price, then began to drain. By the day before the Kelp hack they were down to $9.9 billion.

The bridge nobody was watching

Kelp had made rsETH available on more than 20 blockchains, separate networks that are cheaper to use than Ethereum. To do it, it used a bridge built on software from LayerZero Labs. A bridge works like a currency desk at a border: the real rsETH stays locked in a safe on Ethereum, and the other networks get vouchers. When a voucher is destroyed, the safe releases the real token.

The safe trusted a single checker, run by LayerZero itself. According to LayerZero, attackers took over the servers that checker relied on and fed it a fake report of tokens destroyed on another network. One signature, and the safe opened. LayerZero blamed TraderTraitor, a North Korean hacking unit within the Lazarus Group; no government has formally confirmed that and nobody has been charged.

The attacker did what liquid restaking customers had been taught to do. Most of the stolen rsETH was pledged on Aave, and about 82,650 real ether was borrowed against it. Aave froze its rsETH markets, as did SparkLend and Fluid. Aave estimated possible bad debts, loans that would never be repaid, at $124 million to $230 million, and lenders ran. Aave's deposits fell from $26.4 billion to below $14 billion, according to Cointelegraph. Holders of ezETH and weETH sold too, though their bridges had not been touched. The market did not try to tell one receipt from another.

That was the lesson. Liquid restaking had bundled three risks into one token: slashing, bugs in the LRT firm's own code, and the bridge. Most customers had only heard about the first. The third broke.

Rescue, and what is left

The industry paid for the hole. Aave led a rescue fund, DeFi United, joined by Consensys, Arbitrum, Lido, ether.fi, LayerZero and Kelp itself, with pledges above $300 million. The Arbitrum Security Council froze 30,766 ether the attacker had left on its network. Kelp reopened withdrawals on 15 May, and on 25 May said the final 20,373.7 rsETH had been put back, closing "the operational part" of its recovery. The rest of the stolen money, about $220 million, was laundered through THORChain and privacy tools by June.

Then came the lawyers. Kelp and LayerZero blamed each other for the single checker. In late September 2026 Evercrest Technologies, the company behind Kelp, sued LayerZero and its co-founder Bryan Pellegrino in the Supreme Court of British Columbia. Pellegrino called the claim "meritless". American families holding court judgments against North Korea have claimed the frozen ether as North Korean property; that dispute is still open in a New York federal court.

On 16 October 2026 DefiLlama showed EigenLayer, now called EigenCloud, holding about $6.3 billion. Kelp held about $1.0 billion, down from $2.1 billion at its peak, and Renzo about $110 million, down from $4.05 billion. EIGEN traded at about $0.25, 96% below its peak. Part of the fall is the ether price, which dropped from about $4,600 in mid-August 2025 to about $2,450, but even counted in ether the deposits have fallen by about 45%.

EigenLayer still runs, and so do Kelp, ether.fi and Renzo. What died is the claim that restaked receipts were as safe as the ether behind them, a building block that any app could accept as collateral without asking what it was standing on.