Exploit contagionEthereum, past incidentContagion

Kelp DAO rsETH

18 April 2026. A forged bridge message released rsETH, and the attacker borrowed against it.

78 min

ahead of the lenders' rush

WETH withdrawn from Aave per half hour, $MNOCKpeople leaving

What happened, in order
Time	What happened	Amount
17:35	Stolen rsETH lands in a fresh wallet	$294.4M
17:42	A quarter of it is now collateral on Aave and Compound	$128.9M
17:42	NOCK calls exit() on your guard	to you
19:00	The big lenders rush out	$685.6M

At 17:35 UTC $294.4M of rsETH landed in a fresh wallet. 7 minutes later it was collateral on Aave and Compound, and NOCK's alarm fires. The big WETH lenders left 78 minutes after that. Then withdrawals stopped working.

78 min
ahead of the lenders' rush: $213.2M
posted as collateral in 15 minutes: $685.6M
lenders pulled in one hour: $190.0M
bad debt left, as reported

AThe evidence

Arrival: $294.4M via lzReceive, into a wallet with no Nansen label
Spread across: 13 more wallets inside the window
Collateral posted: Compound WETH (cWETHv3) $2.5M at 17:39
Aave rsETH (aEthrsETH) $12.6M at 17:40
Aave rsETH (aEthrsETH) $50.5M at 17:41
Compound WETH (cWETHv3) $63.2M at 17:42
Aave rsETH (aEthrsETH) $70.7M at 17:43
Compound wstETH (cWstETHv3) $12.6M at 17:49
Aave rsETH (aEthrsETH) $1.0M at 17:50
The detector: contagion when 25% of an unexplained $50M arrival becomes collateral within 15 minutes

Source: Nansen API, tgm/transfers. Captured 2026-09-24 03:20 UTC, recomputed on every view by the detector the watch runs. These thresholds were set on this one case; they are a starting point, not a promise.

BMore cases