On 18 April 2026, a Saturday evening, the Kelp DAO rsETH token was exploited through a vulnerability in its LayerZero V2 bridge. The bridge's security relied on a single point of attestation; once attackers compromised it, a malicious funds release on Ethereum looked legitimate to the protocol. In one transaction, exactly 116,500 rsETH (~$292m) was released to the attacker. The released rsETH wasn't backed by anything on the other side of the bridge. Every protocol holding rsETH as collateral was suddenly carrying tokens that could no longer be redeemed at parity. Lending markets at Aave, SparkLend, Compound and Fluid paused rsETH within hours. Vault products at Lido and Upshift froze new rsETH deposits.

KPK's emergency response plan activated 20 minutes after the first alert came in. Over the next 24 hours, a cross-functional team coordinated precautionary deposit halts on potentially affected vaults, market-by-market reviews, DAO treasury assessments, multi-stakeholder communications, and a phased re-enabling process. Continued treasury and curation work ran for another two weeks.

This is what that looked like from the inside, including where the system worked, where it didn't, and what changed because of it.

The first minutes

KPK uses third-party threat-detection platforms that monitor onchain activity in real time. Some incidents trip those platforms directly. Others surface through human channels first: a trusted security account on X, a partner protocol's status channel or a Telegram message. The Kelp incident was the second kind.

Whatever the source, the emergency response plan is initiated. The plan assigns clear roles: an on-call lead who drives the response; analysts who identify affected positions; strategy leads who decide the action plan; an engineering lead who handles technical solutions; a communications lead who manages external messaging; and legal counsel who approves anything that goes out.

Automated execution, and human escalation

KPK's infrastructure uses automated agents that continuously manage allocations across approved markets and protocols. They maintain withdrawal liquidity, monitor risk parameters, and execute rebalances. When a high-confidence risk alert fires on one of KPK's preconfigured incident triggers, exit agents pull liquidity out of the position before a human is even in the loop.

Kelp went differently. KPK's automated triggers covered the markets where rsETH was used as collateral, but the bridge-level attack vector required manual escalation. The war room was activated within 20 minutes of the first signal. Thirteen minutes later, the team manually triggered the exit agent, which pulled the first batch of rsETH-exposed liquidity from the affected market onchain (tx). As a precaution, the team also paused potentially affected markets across the KPK-curated Morpho vaults, including those with indirect Aave exposure. In parallel, KPK unwound matching positions in the institutional treasury mandates it manages on behalf of DAOs. Both stacks use the same KPK Permissions Layer.

The Permissions Layer is the non-custodial smart-contract framework that defines what the asset manager can and cannot do, without ever taking custody of client funds. No new approvals or keys are needed during a crisis; the permissions were already in place. The asset manager can move in seconds, but only inside the lines drawn when the mandate was deployed.

Speed matters here. Every minute a vulnerable position stays open is a minute of exposure. The combination of automated first response and human escalation is designed to compress that window.

Assessing the blast radius

Once the immediate exposure was contained, the next task was mapping the full scope. Which DAO treasuries or vaults held direct or indirect exposure through affected protocols? Were there second-order contagion risks via shared oracles, shared collateral types, or shared bridge infrastructure?

KPK manages capital across multiple DAO treasuries and public vaults. Each operates independently, with distinct mandates, risk parameters, and stakeholders. An incident like rsETH requires a separate assessment for every portfolio against every potential exposure path.

KPK led that matrix across six DAOs in parallel, unwinding at-risk positions where contagion risk warranted and producing tailored impact summaries published on each DAO's governance channel: ENS, CoW DAO, Arbitrum, Balancer, Nexus Mutual, and dYdX. Some required precautionary exits from positions with contagion risk. Others were confirmed unaffected. Each confirmation was logged, timestamped, and communicated to the relevant governance contacts.

Thanks KPK team for the quick action and work during and after the incident. Showing again how valuable it's to have a treasury manager, with multiple tools (like hypernative) and 24/7 capacity to move funds.

We have seen a lot of hacks lately, so it becomes even more important to have proper due diligence on assets' trust assumption and have the best security practices in place.

netto.eth, responding on the ENS governance forum

For the curated vaults, the assessment ran at the market level against KPK's existing risk framework. Each one was evaluated individually against direct and indirect rsETH exposure, lending-protocol contagion risk, LayerZero DVN exposure, oracle robustness, and liquidation health under stress.

This is the unglamorous core of crisis management. Not heroics. Data analysis, cross-referencing, and methodical verification.

Communication under pressure

KPK follows a three-stage communication protocol during emergencies. Stage one: acknowledge immediately. The team is aware and responding. No detail, no speculation. Stage two: update with actions taken. Deposits halted, positions exited, scope confirmed. Stage three: resolve with a full account of what happened and what changed. Each stage requires legal sign-off before anything goes external. That sounds slow, but it prevents the kind of premature disclosure that creates panic or legal exposure.

The challenge specific to an onchain asset manager is communicating with multiple audiences in parallel: DAO treasury committees through their governance channels, public-vault depositors with factual reassurance, and the wider market that reads silence as weakness and speculation as incompetence.

The Resolv response on 22 March 2026 was the proving ground for this framework. Same-day public acknowledgement. Detailed resolution update once the scope was confirmed. The first public post went out in a matter of hours: KPK's teams are responding, coordinating with relevant protocols and counterparties, and a fuller update will follow. Short. Factual. No numbers. No speculation about other projects or protocols.

Over the next two days, each DAO received tailored updates through their designated communication channels, reflecting the specific exposure (or lack of it) for that treasury.

Why drills matter more than playbooks

KPK runs emergency drills on a recurring cadence. Quarterly company-wide, plus additional monthly drills inside the risk curation function, extra reps on the most likely-to-fire scenarios. The drills are designed from real attack classes: multisig compromises, flash loan exploits, oracle failures, liquidation cascades, stablecoin depegs.

In March 2026, a month before rsETH, the team ran a drill simulating a RedStone oracle malfunction. The team walked through detection, escalation, decision-making under incomplete information, and the actual exit path, including building the transaction payloads to hot-swap the affected oracles in production. Those payloads can now be wired into the threat-detection platform for fully automated emergency response.

Drills cover people as much as systems. Every KPK team member with key access, not just signers, was independently audited by Opsek, a security firm specialising in operational security for high-value crypto roles. Phishing resistance, secure key storage, communication hygiene, recovery procedures.

The same discipline applies to tooling and code. KPK's threat detection combines Hypernative and Cyvers for onchain monitoring, with most monitors configured in-house and wired into KPK's own automation layer for execution. KPK's smart-contract infrastructure was independently audited by Cantina in December 2025. Third-party security tooling is part of KPK's own code-review workflow.

Post-mortems extend the discipline. KPK runs them after every incident, and after every false alarm. A dismissed threat that wasn't communicated fast enough reveals a process gap. A real alert that took too long to reach the right person reveals a detection gap. Both get fixed. Hot washes (within hours of the incident) capture the picture while memory is fresh. Full post-mortems (within 48 hours) produce the structural changes.

The long recovery

An incident doesn't end when the immediate threat passes. For an asset manager, the harder work begins after the crisis: deciding what to re-enable, what to offboard permanently, and what needs structural changes.

KPK reviewed every market and treasury exposure individually. Markets that passed the full assessment, unaffected by Aave contagion, no LayerZero DVN exposure, and healthy liquidation profiles, were re-enabled. Healthy treasury positions were held. Markets that failed were offboarded.

Some decisions were straightforward: markets with direct rsETH collateral exposure were removed. Others were more nuanced. Allocation caps were reduced on markets where TVL had shifted significantly post-incident. Before the 8 May offboarding pass, KPK ran a per-market interest-generated query across all 55 markets in the curated vaults over the last 90 days; markets contributing less than 1% of vault interest were flagged for offboarding. Every change was documented in the public vault changelog.

The Gearbox side ran in parallel. On 18 April, KPK pre-emptively reduced exposure on both Gearbox markets, removing Kelp-adjacent collateral types as a precaution. The ETH-pool IRM was flattened on 21 April. By 9 May, the full re-tune was complete, with the most-impacted assets permanently offboarded.

KPK's co-founder Marcelo participated personally in DeFi United, a cross-ecosystem coordination effort to recover exploited funds. At time of writing, the recovery fund exceeds the exploit amount; Kelp has confirmed funds are fully covered.

What changed after rsETH

Every incident reveals things that could be better. Here's what shipped at KPK in the weeks after the rsETH exploit. Most of it is already live onchain or in production.

Detection coverage and automated triggers. KPK had monitoring in place for the rsETH market, but the exploit class itself fell outside the pre-configured triggers. KPK has since mapped remaining gaps across oracle attacks, governance attacks, and bridge exploits, shipped 97 new monitors to cover them, and extended the scope of conditions that trigger automatic fund movements without waiting for human confirmation. For the most composable collaterals, KPK also wires the upstream protocol dependencies into the alerting layer. KPK now also automatically screens X for signals from trusted security accounts. Not all emergencies give you 10 minutes to assess; some give you seconds.

On-call infrastructure. KPK has introduced a formal on-call rotation with phone-based escalation. Every high-severity alert is wired through PagerDuty so it reaches the on-call responder's phone outside regular working hours.

Depeg-monitoring methodology. For markets with fundamental oracles, KPK now runs a layered detection setup: secondary-source price comparison (combining multiple sources) with per-asset thresholds derived from historical analysis.

Forced rebalances on user withdrawals. Every significant user withdrawal from KPK-curated Morpho vaults automatically triggers a forced rebalance, keeping vault allocations on target rather than allowing them to drift between scheduled cycles. Round-trip from alert to onchain execution: 17 seconds (example tx).

In-house safety tooling. KPK built internal tools to scope Safe transaction proposals to each client's pre-approved permissions and to verify transactions before signing, reducing signer error and blocking the primitives behind common multisig attack vectors.

The point of the list is the cadence: every incident closes with a list of changes that ship.

Crisis management is an operating discipline. It improves only if you drill it, break it, and fix what surfaces. KPK treats it that way.