Kelp Review 2026: Liquid Restaking and the April rsETH Bridge Hack

Kelp, also called Kelp DAO, is a liquid restaking protocol on Ethereum. Users deposit ETH or major liquid staking tokens and receive rsETH, which keeps its liquidity while the underlying assets are restaked. DefiLlama lists it under Liquid Restaking, with about $910M in TVL, a KERNEL token and two listed audits. It has been listed since December 2023.

The key fact for 2026 is the security incident. On April 18, 2026, an attacker exploited Kelp's rsETH cross-chain bridge and took about 116,500 rsETH, valued at roughly $290M to $292M and described as about 18% of rsETH supply. Aave froze rsETH markets and an Arbitrum freeze followed. Kelp blamed LayerZero default settings for the single-validator setup, which others dispute. In May 2026, Kelp said it would stop rsETH bridging on 20 networks.

The homepage still markets Kelp as battle-tested and institutional grade with $2B+ TVL, but DefiLlama's current figure is much lower. Readers should treat the homepage as marketing and weigh the incident reports.

Restaking lets ETH that is already staked, or staked through a liquid staking token, secure additional services and earn extra rewards. Kelp pools user deposits and mints rsETH as a receipt token. Because rsETH is a tradable token, holders can keep using it in DeFi instead of locking capital.

The design has layers of risk. rsETH depends on Kelp's contracts, the underlying staking and restaking infrastructure, and for cross-chain use, the bridges that carry it between networks. The April 2026 exploit hit that bridge layer rather than the core deposit contracts, according to press reports, but it still hurt rsETH confidence and liquidity.

Kelp's fee structure is not stated. The homepage shows APR and APY figures and a calculator, but no values were captured, and no protocol fee on rewards is described.

Before depositing, check the Kelp app and documentation for any fee taken on staking rewards, plus Ethereum gas costs and any DEX slippage if you exit by swapping rsETH instead of withdrawing.

Kelp lists audits and a bug bounty up to $250K, and DefiLlama counts two audits. Audits reduce risk but do not remove it. The April 18, 2026 bridge exploit, with about 116,500 rsETH stolen according to press reports, shows that integration and configuration choices can fail even when the core contracts were audited.

Blame is contested. Kelp pointed to LayerZero defaults that allowed a single-validator setup, while commentators called it another bridge failure. Aave froze rsETH markets and Kelp later said it would halt bridging on 20 networks. Users holding rsETH should follow official communications for recovery and compensation plans, which are not described publicly. Restaking is non-custodial but exposes you to smart-contract, bridge and de-peg risk.

Kelp suits experienced DeFi users who already hold ETH or liquid staking tokens, understand restaking risk, and want a liquid receipt token. It is a poor fit for people who cannot tolerate smart-contract or bridge losses, or who want fully clear fee and recovery terms before depositing.