The Ethereum-based restaking protocol Kelp DAO has announced a temporary suspension of transactions for a specific wallet address following the detection of suspicious activity. The security measure was implemented on September 15, 2026, after a user's Safe multi-signature wallet was compromised, leading to a loss of approximately $1.73 million. Despite the targeted attack on the individual wallet, Kelp DAO officials confirmed that the protocol’s core infrastructure remains unaffected and all user funds within the restaking pool are safe.
Security Measures and Protocol Integrity
In response to the breach of the external wallet, Kelp DAO developers initiated a 24-hour freeze on the suspected address to prevent the movement of rsETH (Liquid Restaking Tokens). During this window, the address is prohibited from both incoming and outgoing transfers. The protocol team emphasized that this is an isolated incident involving a specific user's security and not a systemic vulnerability of the Kelp ecosystem.
- Contract Status: All smart contracts governing Kelp DAO remain secure and audited.
- Collateralization: rsETH remains 100% collateralized by underlying assets.
- Functionality: Minting, redemption, and DeFi integrations continue to operate without interruption for all other users.
Liquid restaking protocols like Kelp allow users to deposit Liquid Staking Tokens (LSTs) to earn additional rewards while maintaining liquidity through tokens like rsETH, which represents their position in the restaking market.
Details of the Multi-Signature Wallet Breach
Reports indicate that the vulnerability originated from a Safe (formerly Gnosis Safe) multi-signature wallet on the Ethereum mainnet. The attackers managed to gain unauthorized access, siphoning funds shortly after the wallet had interacted with the Kelp protocol. While the specific method of the exploit is still under investigation, early data suggests the loss totals roughly 1.73 million dollars in digital assets.
Kelp's contracts are secure, rsETH remains fully collateralized, and minting, redemption, and integration functions are operating normally. Users do not need to take any action.
The protocol team is currently monitoring on-chain data to track the movement of the stolen funds and is working with security researchers to mitigate further risks. The suspension of the involved address is a precautionary step to limit the attacker's ability to liquidate the stolen rsETH through decentralized exchanges or other liquidity pools.
In conclusion, Kelp DAO has acted swiftly to contain the impact of an external wallet exploit, ensuring that the broader Ethereum restaking ecosystem remains stable. As the 24-hour suspension period progresses, the protocol maintains that its internal security mechanisms have prevented a wider contagion. Standard users are advised that no manual action is required, and the platform continues to provide full transparency regarding the safety of the rsETH collateral.
Frequently Asked Questions
Quick answers to the most common questions about this topic.
For educational purposes only. Nothing here constitutes financial or investment advice. Crypto markets are highly volatile — always DYOR before making any decisions.
Fact-checked per our editorial policy. We maintain strict independence from advertisers. Spot an error? Let us know.