Hotcoin Research | Is the High-Yield Restaking Bubble Starting to Burst? Systemic Risks in LRT Exposed by the Kelp DAO Hack
TL;DR
Background: The Kelp DAO rsETH incident highlights that LRT is not simply a yield-enhanced version of ETH, but a complex yield instrument dependent on multiple layers of external infrastructure. Concept & Use Cases: LRT enhances capital efficiency through “staking → restaking → liquid tokenization,” and is deeply embedded in lending, leverage loops, and cross-protocol composability. Issuer Landscape: The market is highly concentrated, with ether.fi focusing on scale and liquidity, Kelp on multi-chain expansion, and Renzo on strategy management and risk control. Risk Events: The Kelp incident shows how technical failures can propagate into lending systems, while the Renzo depeg illustrates how incentive misalignment can trigger market-wide sell-offs. Core Risks: Technical Risk | Economic & Incentive Risk | Governance & Operational Risk | Liquidity & Structural Risk | Regulatory & Compliance Risk Conclusion: LRT improves capital efficiency but amplifies systemic risk; future competition will shift from chasing high APR to prioritizing security architecture and risk management.
On April 18, 2026, approximately $292 million was stolen from Kelp DAO, making it the largest DeFi security incident so far this year. Attackers exploited the LayerZero cross-chain messaging system to forge transactions, leading to the minting of approximately 116,500 unbacked rsETH. These tokens were then rapidly deposited into lending protocols such as Aave as collateral to borrow large amounts of real ETH and other assets, exposing multiple platforms to significant bad debt risk and triggering widespread liquidity withdrawals across DeFi, with LRT assets coming under broad pressure.
This incident makes it clear that LRT is not a "yield-enhanced version of ETH". Its value is highly dependent on the proper functioning of multiple layers of external infrastructure, including bridges, oracles, and AVS. A failure at any layer can instantly turn seemingly safe collateral into high-risk assets.
I. The Concept and Function of LRT Assets
LRT, or Liquid Restaking Token, represents a core asset form within the Ethereum restaking ecosystem, primarily built on restaking protocols such as EigenLayer. At its core, LRT packages additional "restaking yield" on top of traditional ETH staking returns.
-
LRT Creation Path
The generation path of LRT can be summarized in three steps:
-
Users first stake ETH on Ethereum to receive LSTs (Liquid Staking Token), such as stETH;
-
These LSTs are then deposited into restaking protocols to help secure additional network services;
-
The protocol issues LRT as a liquid representation of the user's restaked position.
These additional network services are typically referred to as AVS (Actively Validated Services), which can be understood as modular services that leverage Ethereum’s shared security.
-
Core Functions of LRT
The value of LRT lies primarily in two dimensions: yield stacking and liquidity retention.
-
Liquidity retention: Users are not required to lock assets long-term. LRT can be freely traded or deployed across DeFi strategies such as lending, liquidity provision, and yield aggregation.
-
Yield stacking: A single underlying asset can simultaneously generate Ethereum staking rewards, additional restaking or AVS incentives, and further DeFi-based yields such as points or strategy returns.
-
Capital efficiency: Compared to holding LSTs alone, LRT enables the same asset to participate in multiple yield layers, positioning it as a central yield hub within the restaking ecosystem.
-
LRT vs. LST
LRT can be viewed as an extension of LST, but the two differ fundamentally:
-
LST: Returns are derived from Ethereum staking, with risks largely tied to the Ethereum validator mechanism;
-
LRT: Builds on LST by introducing additional yield sources, along with added risks from AVS and restaking layers.
In essence, LST functions as a “base yield asset,” while LRT is a more complex, structured product that introduces leverage, external dependencies, and additional layers of risk.
Compared to LST, LRT carries significantly higher risk. While LST relies primarily on Ethereum’s native staking mechanism, LRT introduces multiple layers of trust assumptions, including AVS slashing risk, operator risk, cross-chain bridge risk, and smart contract complexity.
For many investors, LRT is often perceived as a "high-yield instrument", but in reality, it is a bundled exposure to multiple external assumptions.
From a product perspective, LRT is not simply an upgrade of LST. It functions as both a yield amplifier and a risk amplifier, enhancing capital efficiency while simultaneously concentrating risks that were previously distributed across multiple protocols and modules. As a result, LRT is not only one of the most compelling innovations in the restaking space, but also a core asset that must be carefully understood and properly priced.
-
DeFi Applications of LRT
The rapid expansion of LRT is driven not only by its additional yield, but by its deep integration into DeFi. Unlike early LSTs, which mainly functioned as staking receipts, LRT serves multiple roles: it is simultaneously a yield-bearing asset, a collateral asset, and a building block for cross-protocol leverage loops.
Users can deposit LRT into lending protocols, borrow ETH or stablecoins, and redeploy the borrowed capital into additional LRT positions, liquidity pools, or other yield strategies. This transforms LRT from a passive holding into a core intermediary layer for capital efficiency in DeFi.
LRT use cases can broadly be categorized into three types:
-
As collateral in lending protocols (the primary use case);
-
As the base asset for recursive leverage strategies, enabling a yield amplification loop of depositing LRT, borrowing ETH or stablecoins, and increasing LRT exposure.
-
As a component in higher-order structured strategies, including yield vaults, cross-market allocation, and integration with derivatives and stablecoin strategies.
Through these applications, LRT has evolved from a protocol-native asset into a system-level asset within DeFi. It brings yield-bearing assets into the core lending stack, while simultaneously introducing both yield amplification and risk amplification into the system.
On one hand, LRT significantly enhances the capital efficiency of ETH-based assets. It enables assets that previously only generated base staking yields to participate in lending, leverage, and cross-protocol strategies, thereby improving overall capital utilization across DeFi.
On the other hand, LRT fundamentally reshapes the risk profile of lending protocols. Protocols must now account not only for ETH price volatility, but also for the complexities of yield-bearing asset pricing, oracle design, liquidity depth, bridge security, restaking mechanics, and liquidation pathways.
Recent discussions around the rsETH incident have highlighted how high LTV ratios, bridge risks, and recursive leverage can interact to create systemic fragility.
II. Overview of Major LRT Issuers
From 2024 to 2026, the LRT sector rapidly evolved from a proof-of-concept stage into a phase of large-scale competition. Within just two years, the market expanded from near zero to almost $8 billion, reflecting strong demand from DeFi users for capital efficiency.
As of April 23, 2026, according to DefiLlama, total TVL in the liquid restaking sector exceeded $7.8 billion. Among the leading protocols, ether.fi accounted for $5.417 billion, Kelp for approximately $1.5–1.6 billion (across 16 chains), Renzo for about $399 million, and Mantle Restaking for roughly $175 million.
The market has already developed a clear concentration at the top, with the three leading protocols capturing the majority of market share. Other players are primarily exploring differentiation through niche use cases, multi-chain deployment, and varying risk profiles.
Source: https://defillama.com/protocols/liquid-restaking
If we look at token market capitalization, concentration is similarly evident. As of April 23, 2026, CoinGecko data shows that weETH has a market cap of approximately $5.66 billion, rsETH around $1.3 billion, and ezETH about $439 million.
Source: https://www.coingecko.com/en/categories/liquid-restaking-tokens
This suggests that the market is no longer pricing LRTs purely based on the shared “restaking” narrative. Instead, differentiation is increasingly driven by protocol scale, liquidity depth, cross-chain architecture, DeFi integration, and risk exposure structures.
In other words, while LRTs may appear homogeneous on the surface, their underlying protocol quality and systemic risk profiles vary significantly.
-
ether.fi: Scale, Liquidity, and Ecosystem Integration
Among current LRT providers, ether.fi stands out as the clear market leader. Its core products include eETH and weETH: the former represents an auto-compounding restaked ETH position, while the latter is a wrapped version with fixed supply designed for broader DeFi composability.
Users deposit ETH to receive eETH, which can then be wrapped into weETH for wider use across DeFi. This means ether.fi is not merely issuing a restaking token, but building a full-stack asset framework tailored to different use cases.
Overall, ether.fi resembles a “blue-chip” LRT issuer. Its strengths lie not in maximizing yield, but in scale, liquidity, asset standardization, strong DeFi adoption, and relatively mature governance.
According to its official disclosures, its assets have been integrated into more than 400 DeFi protocols, including Pendle, Aave, Morpho, Balancer, Aura, Uniswap V3, and Convex. This suggests that weETH is not merely a passive holding asset, but deeply embedded across lending, derivatives, liquidity provision, and yield aggregation.
-
Kelp/Kernel DAO: Multi-Chain Expansion and Structural Risk
Kelp DAO has been evolving toward the Kernel DAO brand, but its core asset rsETH remains one of the most significant LRTs in the market. With TVL in the $1.5–1.6 billion range, Kelp ranks second in the liquid restaking sector. rsETH has already expanded across more than 10 major L2 networks and over 40 DeFi platforms, highlighting its role as a highly composable, cross-chain yield asset.
Compared to ether.fi, Kelp places greater emphasis on multi-chain expansion and external integration efficiency. If ether.fi is focused on building a dominant liquidity hub within Ethereum, Kelp is more akin to a strategy of rapidly scaling cross-chain distribution networks.
This approach enables faster user acquisition and broader integration across lending, liquidity, and incentive ecosystems, allowing rsETH to be more easily embedded into various on-chain use cases. As a result, its growth trajectory was once highly impressive. According to CoinGecko, rsETH’s market capitalization remained around $1.3 billion in late April 2026, indicating that it has retained a substantial asset base even after a major security incident.
However, the very architecture that supports rapid expansion also introduces structural vulnerabilities. The recent exploit revealed critical weaknesses in its cross-chain design, particularly the reliance on a single-DVN configuration in its rsETH bridging setup.
Once this component fails, the impact is not confined to a single chain. Instead, it undermines rsETH’s role as the trust anchor of an entire cross-chain asset system.
-
Renzo: Institutional Positioning and Strategic Abstraction
Compared to ether.fi and Kelp, Renzo operates at a smaller scale, but still maintains a position among leading protocols. Renzo positions itself as an institutional-grade platform, emphasizing transparency, security, and controlled exposure to advanced yield strategies. This reflects an effort to differentiate from purely retail-driven high-yield narratives.
Its core competitiveness lies in two areas:
First, strategy abstraction. For users, the complexity of restaking lies not in depositing ETH, but in managing validators, AVS exposure, yield sources, and risk distribution. Renzo aims to package this complexity into standardized, user-friendly products.
Second, institutional-grade risk management and transparency. Its documentation emphasizes risk disclosure, mitigation mechanisms, and operational safeguards such as delays or suspension when necessary.
Overall, Renzo lacks the scale advantage of ether.fi and the aggressive expansion strategy of Kelp, but positions itself as a more professional and risk-aware platform.
-
Other Key Players: Mantle, Swell, and LBTC
Beyond the top three, Mantle Restaking and Swell also represent important participants in the LRT sector. Mantle leverages ecosystem synergies, particularly through its ties with Bybit, to build a more closed-loop system. Swell focuses on product differentiation and composability within its own ecosystem. Their importance lies not in short-term competition with leading players, but in demonstrating that the LRT sector is not solely driven by scale, and that alternative paths such as ecosystem alignment and vertical specialization also exist.
Another noteworthy development is Lombard’s LBTC. While not strictly part of ETH-based LRT, it reflects the broader trend of extending the “restaking + liquidity packaging” model to other assets such as BTC and SOL. This suggests that LRT is evolving from an Ethereum-specific concept into a more generalized framework for composable yield-bearing assets.
Overall, the differences among LRT issuers ultimately converge on a single question: how a protocol balances capital efficiency, liquidity expansion, and security boundaries. Ether.fi is closer to a conservative market leader, building its moat through scale, liquidity, and product maturity. Kelp DAO and Kernel DAO are more aggressive expanders, with strong multi-chain deployment and DeFi integration capabilities, but also higher structural risks stemming from bridging complexity. Renzo Protocol sits somewhere in between, placing greater emphasis on strategy management and institutional-grade risk controls, though it remains inherently part of the high-complexity LRT asset class.
Within the LRT space, no issuer can offer absolute safety. What exists instead is a spectrum of trade-offs across different risk structures. For this reason, the differences among LRT issuers are not merely product distinctions, but rather the result of how the market prices these varying risk profiles.
III. Case Studies of LRT Risk Events
-
Kelp DAO rsETH Exploit
The Kelp DAO rsETH incident on April 18, 2026 stands as one of the most representative risk events in the LRT sector so far this year, and marks the first time that the composability risks of restaking assets have been exposed in such a concentrated and systemic manner.
Attackers compromised the downstream RPC infrastructure relied upon by LayerZero Labs’ DVN and, in conjunction with DDoS attacks, forced the system to revert to a manipulated node view. This ultimately enabled them to forge a cross-chain message that had never actually occurred, causing the Kelp bridge to erroneously mint 116,500 rsETH. At the time, this amounted to approximately $290 million, or roughly 18% of its circulating supply. As a result, rsETH, which should have been fully backed one to one by underlying assets, was instantly transformed at the bridge layer into a large volume of unbacked circulating assets.
What makes this incident particularly worth examining is not merely the scale of the loss, but the distinctly DeFi-native transmission mechanism it revealed. Rather than simply dumping rsETH on the market, the attackers rapidly deposited these unbacked tokens into lending protocols and used them as legitimate collateral to borrow real assets. Protocols such as Aave, SparkLend, and Fluid were consequently forced to freeze affected markets to prevent further accumulation of bad debt.
In other words, the attack did not stop at the level of a bridge compromise. Instead, it propagated along a full DeFi credit chain, with forged assets entering lending markets, extracting real liquidity, and ultimately leaving behind residual bad debt risk.
This allowed the impact to spill over rapidly into the broader DeFi credit system.
Compared with traditional smart contract exploits that simply drain funds, this type of attack is closer to injecting counterfeit collateral into a financial system and extracting real capital from it.
Within two days of the incident, more than $13 billion in total value locked was withdrawn across multiple platforms. This indicates that the market reaction was not limited to rsETH itself, but quickly escalated into a broader risk repricing of LRT and LST assets as well as related lending structures.
-
Renzo ezETH Depeg
In addition to the Kelp incident, another earlier but equally representative case was the Renzo Protocol ezETH depeg in April 2024.
Following strong user backlash over the REZ tokenomics and airdrop allocation, ezETH experienced a sharp deviation from its peg, trading at a discount of approximately 18.3% relative to ETH at its peak.
This event was not the result of a technical exploit, but rather a classic chain reaction of incentive design failure, loss of market confidence, liquidity-driven sell pressure, and a widening price discount.
It highlights that LRT risks do not stem solely from smart contracts or cross-chain infrastructure. In some cases, protocol incentives, exit expectations, and market sentiment alone are sufficient to trigger severe dislocations.
Compared with the Kelp incident, the Renzo event was less technically destructive, but carried significant market signaling value. It demonstrates that the stability of LRT pegs depends not only on underlying asset backing, but also on user confidence in redemption mechanisms, token distribution, and forward expectations.
Systemic Implications
When viewed together, these two events make the systemic nature of LRT risk much clearer. The Kelp incident represents a technical failure leading to a collapse of credit assumptions. The Renzo incident represents an incentive and sentiment imbalance triggering market-driven stress. Both ultimately point to the same conclusion. LRT yields do not exist in isolation. They rely on the stability of multiple interconnected layers, including bridge security, lending parameters, liquidity depth, incentive design, and governance expectations. This also highlights that LRT multi-chain expansion and deep integration into DeFi are fundamentally double-edged. On one hand, LRT enables efficient capital circulation across bridges, lending protocols, yield vaults, and derivatives markets, delivering significantly higher capital efficiency than traditional staking assets. On the other hand, this high level of composability introduces more pathways for cross-protocol contagion and risk amplification. Under normal conditions, this structure functions as a highly efficient capital network. However, under stress scenarios, it also means that once any single component becomes compromised, risk can propagate downstream at a speed far exceeding that of traditional financial systems.
IV. Core Risk Breakdown of LRT
The expansion of restaking assets is inherently accompanied by a simultaneous increase in bridging risk, cross-protocol complexity, and systemic interdependence. In other words, LRT is not a single risk asset, but a structured yield instrument that repackages multiple layers of risk.
1. Technical risk: This category primarily includes smart contract vulnerabilities, oracle failures, and cross-chain risks. The Kelp DAO incident was largely driven by the use of a single DVN configuration for rsETH. Attackers were able to forge messages by compromising downstream RPC infrastructure, ultimately leading to the erroneous release of assets. This suggests that as cross-chain circulation becomes standard for LRT, bridges and validators are no longer auxiliary components, but integral parts of the asset’s credit framework, directly determining whether it can maintain a credible peg.
2. Economic and Incentive Risk: LRT exposure extends beyond ETH price volatility. In addition to staking returns, it also carries risks related to AVS slashing, operator errors, and failures in additional reward mechanisms. Academic research generally suggests that the key issue with restaking is not simply the addition of another yield layer, but the introduction of additional sources of liability and loss. Once underlying services, restaking nodes, or reward distribution mechanisms fail, the resulting losses do not remain confined within the protocol. Instead, they are directly reflected in price discounts, user outflows, and market repricing.
3. Governance and Operational Risk:
Most LRT protocols have yet to achieve full decentralization. Critical operations such as suspension, upgrades, parameter adjustments, bridge restrictions, and emergency responses still rely heavily on multisig control or core operational teams. In the Kelp incident, both the protocol and related infrastructure responded relatively quickly, indicating that industry-level emergency response capabilities are improving. However, this also highlights a structural reliance on human intervention rather than protocol-level self-stabilization under extreme conditions. While this approach may function adequately under normal circumstances, it becomes fragile when the speed of an attack exceeds the response capacity of the team, making it difficult to fully contain losses.
4. Liquidity and Structural Risk: This category is often more subtle than technical risk, as it does not necessarily originate from protocol failure, but from a loss of market confidence. When LRT experiences large-scale outflows, liquidity pool imbalances, or deteriorating redemption expectations, it becomes more prone to widening discounts and accelerated depegging. In other words, LRT stability depends not only on theoretical redeemability but also on the presence of sufficiently deep market liquidity and viable exit channels in practice.
5. Regulatory and Compliance Risk: As LRT becomes widely used for yield enhancement, collateralization, and cross-chain circulation, it increasingly resembles an on-chain structured financial product. Restaking and its derivative assets are facing growing regulatory scrutiny. Future developments may impact protocol growth and user liquidity through front-end restrictions, tighter regional access, increased disclosure requirements, and potential service provider exits. This means that LRT risk is not confined to on-chain factors, but also arises from its interaction with real-world regulatory frameworks.
It follows that LRT should not be viewed as an enhanced version of LST, nor as a passive income instrument that can be left unattended over the long term. Rather, it should be understood as a high complexity, leveraged asset that requires continuous monitoring. Investors must evaluate not only APR, but also bridge design, liquidity depth, governance transparency, and the protocol’s ability to respond under stress scenarios. LRT does not offer a risk-free yield, but instead represents the coexistence of higher capital efficiency and higher systemic fragility.
V. Implications and Strategy Takeaways
The Kelp incident should not be viewed merely as an isolated protocol failure, but as a catalyst for broader structural reassessment. A more fundamental shift is that LRT is now being reassessed by the market as an infrastructure-level risk asset rather than a simple high-yield instrument.
Factors such as bridge redundancy, collateral admission standards, governance transparency, and emergency response mechanisms are becoming key pricing variables. LayerZero has made it clear that it will no longer sign or validate messages for applications that continue to use a one-to-one configuration. At the same time, lending protocols such as Aave and Spark have adopted a more cautious stance toward the risk boundaries of LRT assets.
From a risk mitigation perspective, a clearer three-layer framework is beginning to emerge.
Protocol Layer:
For LRT issuers, the priority is no longer maximizing yield, but reinforcing the underlying credit structure. This includes adopting multi-DVN validation, introducing greater redundancy in cross-chain messaging, implementing delayed withdrawals, deploying circuit breaker mechanisms, and ensuring the ability to quickly isolate or freeze high-risk modules under extreme conditions.
Following the Kelp incident, competition among LRT protocols is shifting away from APR competition toward security architecture competition.
Lending Layer:
The reason LRT amplifies risk is that it has evolved beyond a yield certificate and has been deeply integrated into lending systems as collateral and a tool for credit expansion.
SparkLend’s use of Isolation Mode for weETH represents a conservative yet practical approach. By imposing debt ceilings, restricting collateral types, and limiting borrowable assets, it contains the spillover risk of high complexity assets within a controlled scope.
Going forward, more lending protocols are likely to adopt similar measures, including isolation modes, dynamic LTV adjustments, segmented market parameters, and more frequent risk reassessment, rather than treating LRT as a simple higher-yield substitute for LST.
User Layer:
For individual investors, it is essential to recognize that LRT is inherently a high complexity and highly composable yield instrument, which requires more active monitoring.
The key is not to chase short term APR, but to diversify protocol exposure, manage leverage carefully, assess bridge design and governance transparency, and incorporate LRT into a diversified portfolio rather than treating it as a concentrated position.
Regulatory developments will also become a key variable in the next phase of the LRT sector. On March 17, 2026, the US SEC, with support from the CFTC, issued guidance on the application of federal securities laws to crypto assets and related transactions. This guidance explicitly includes protocol staking and the wrapping of non-security crypto assets within its analytical framework, while noting that certain assets may exhibit hybrid characteristics that require case-by-case evaluation.
For LRT, this suggests that future regulatory focus may center on disclosure obligations, front-end access restrictions, service provider compliance, and systemic importance assessments.
Conclusion
LRT represents one of the latest attempts by DeFi to push capital efficiency forward, but efficiency is never without cost.
Higher yields are not simply about incremental returns. They typically imply greater reliance on bridging infrastructure, more complex credit assumptions, and longer chains of risk transmission.
The LRT sector is unlikely to disappear due to a single event, but it is likely to enter a phase where risk-adjusted security becomes the dominant factor.
Bridge standards will increasingly favor multi-validator redundancy and stricter default configurations. Lending protocols will adopt more conservative collateral parameters, and the market will place greater emphasis on insurance mechanisms, risk isolation, and emergency response capabilities.
The innovation value of LRT remains intact, as it has demonstrably improved the liquidity and capital efficiency of restaked assets. However, the protocols that ultimately endure will not be those offering the highest yields, but those that can maintain verifiable, liquid, and resilient credit structures even under stress conditions.
About Us
Hotcoin Research, the core research and investment arm of Hotcoin Exchange, is dedicated to turning professional crypto analysis into actionable strategies. Our three-pillar framework—trend analysis, value discovery, and real-time tracking—combines deep research, multi-angle project evaluation, and continuous market monitoring.
Through our Weekly Insights and In-depth Research Reports, we analyze market dynamics and highlight emerging opportunities. With Hotcoin Selects—our exclusive dual-screening process powered by both AI and human expertise, we help identify high-potential assets while minimizing trial-and-error costs.
We also engage with the community through weekly livestreams, decoding market hot topics, and forecasting key trends. Our goal is to empower investors of all levels to navigate cycles with confidence and capture long-term value on Web3.
Risk Disclaimer
The cryptocurrency market is highly volatile, and all investments carry inherent risks. We strongly encourage investors to remain informed, assess risks thoroughly, and adhere to strict risk management practices to protect their assets.
Connect with Us
Website：https://www.hotcoin.com/en_US/learn/index/
X: x.com/HotcoinAcademy
Email: labs@hotcoin.com
Đề xuất đọc
Xem thêm
Hotcoin Research | Play and Earn Web3: Castile - A New Era of 3A Idle RPG in the Fantasy Cthulhu Universe
In-depth Research
Hotcoin Research | Predicting the Market Surge: The Rise of the 50-Billion-Dollar Prediction Market and Opportunities Through 2026
In-depth Research
Hotcoin Research | When Leveraged ETFs Meet Perpetual Futures: A Cross-Market Amplifier of Risk and Volatility
In-depth Research
Liên hệ dịch vụ
Service@hotcoin.com
Phản hồi sản phẩm
Product@hotcoin.com
Hợp tác kinh doanh
Business@hotcoin.com
Liên hệ pháp lý
Casecn@hotcoin.com
Về chúng tôi
Phục vụ
hỗ trợ
©2017-2026