TL;DR
Background: The Kelp DAO rsETH incident illustrates that LRT is not a yield-enhanced version of ETH, but a complex yield tool relying on multi-layered external infrastructure.
Concept and Application: LRT enhances capital efficiency through "staking - re-staking - liquidity tokens" and is deeply embedded in lending, leverage cycles, and cross-protocol compositions.
Issuer Landscape: Concentration at the top: ether.fi focuses on scaling, Kelp on multi-chain expansion, and Renzo on strategy management and risk control.
Risk Events: The Kelp DAO incident demonstrates how technical failures can transmit to lending systems, while the Renzo decoupling reflects imbalances in incentives leading to market sell-offs.
Core Risks: Technical risks | Economic and incentive risks | Governance and operational risks | Liquidity and structural risks | Regulatory and compliance risks.
Conclusion: LRT enhances capital efficiency but amplifies systemic risks; the focus of competition will shift from pursuing high APRs to security and risk control capabilities.
On April 18, 2026, Kelp DAO was hacked for $292 million, becoming the largest DeFi security incident of the year so far. The attacker spoofed messages through the LayerZero cross-chain bridge, releasing about 116,500 rsETHs without actual backing, which were quickly deposited into lending protocols like Aave as collateral, resulting in enormous potential bad debts for multiple platforms and prompting DeFi liquidity withdrawal and pressure on LRT assets. This event illustrates that LRT is not "yield-enhanced ETH" as its value highly depends on the normal operation of multi-layered external infrastructure (bridges, oracles, AVS). If any link fails, seemingly safe collateral can instantly become high-risk assets.
1. Concept and Role of LRT Assets
LRT, short for Liquid Restaking Token, is the core asset form in the Ethereum restaking space, primarily built on re-staking protocols like EigenLayer. Essentially, LRT is an asset packaging form that adds "re-staking rewards" on top of traditional ETH staking returns.
Generation Path of LRT
The generation path of LRT can be summarized in three steps:
The user first stakes ETH on the Ethereum mainnet to receive LST (Liquid Staking Token), such as stETH;
Then deposits these LSTs into a re-staking protocol, participating in providing security for other networks;
Based on this, the protocol issues LRT to the user as a liquidity token for their re-staking position.
The so-called other network services are typically referred to as AVS (Actively Validated Services), which can be understood as a category of modular services or protocols requiring the overflow capacity of Ethereum staking security.
Core Functions of LRT
The value of LRT mainly lies in two aspects: “yield stacking” and “liquidity retention”:
Retention of Liquidity: Users do not need to lock their assets for long; after obtaining LRT, they can still trade on secondary markets or further participate in lending, LP, yield aggregation, and other DeFi strategies;
Stacking Yield Sources: A single underlying asset can usually earn Ethereum's native staking rewards, additional incentives from the re-staking protocol or AVS, points, incentives, or yield from certain DeFi scenarios, etc.;
Enhancing Capital Efficiency: Compared to merely holding LST, LRT allows the same asset to support more yield scenarios, thus seen by the market as an important yield nexus in the re-staking ecosystem.
Differences Between LRT and LST
LRT can be considered a further extension of LST, but the two are not equivalent.
LST: Core yields come from staking on the Ethereum mainnet, with risks relatively concentrated in Ethereum's validation mechanism itself;
LRT: Extends further on the basis of LST, in addition to Ethereum staking yields, it also introduces AVS-related yields and additional risks.
In other words, LST is closer to a "base yield asset," while LRT resembles an "advanced yield asset" that continues to leverage on base yields, adds structures and external dependencies. Compared to traditional LSTs, the risks of LRT are significantly higher. LST mainly relies on the Ethereum native staking mechanism, with relatively singular risks; while LRT adds multi-layered trust chains, including the risks of AVS slashing, operational management risks, cross-chain bridge security risks, and the complexity of smart contracts. Ordinary investors often see LRT as a "high-yield tool," but it essentially packages multiple external assumptions into the same asset.
From the perspective of product positioning, LRT is not a simple upgraded version of LST, but rather a "yield amplifier" and "risk amplifier" in the re-staking ecosystem. While it enhances the capital efficiency of ETH-like assets, it also repackages and concentrates risks that were originally dispersed across different protocols and modules. For this reason, LRT is one of the most attractive innovations in the re-staking track while also being a core asset that needs to be understood and priced cautiously.
DeFi Applications of LRT Assets
The rapid expansion of LRT in a short time is not solely due to the additional yields it provides, but because it has been deeply embedded in DeFi protocols. Unlike early LSTs which were mainly viewed as "stake yield certificates," once LRT entered DeFi, it assumed more complex functions: it is both a yield asset and collateral, as well as the underlying material for cross-protocol leverage loops. Users can deposit LRT into lending protocols, borrow ETH or stablecoins, then use the borrowed assets to buy new LRTs, participate in liquidity pools, or invest in other yield strategies. This makes LRT more than just a "holdable asset," but an important intermediate layer for enhancing capital efficiency in DeFi.
From the structural perspective of applications, the usage scenarios of LRT in DeFi can be roughly divided into three categories.
As collateral assets for lending protocols, which is currently the most core use;
As the foundational asset for cyclical leverage strategies, namely the yield amplification path of “deposit LRT - borrow ETH/stablecoins - continue to accumulate LRT”;
Entering higher-level compositional strategies, such as being packaged into yield vaults, redistributed to different markets, or used in conjunction with derivatives and stablecoin strategies.
On these structures, LRT completes the transition from "protocol endogenous assets" to "DeFi system-level assets." It formally brings "yield assets" into the mainstream lending system while introducing both "yield amplification" and "risk amplification" into the lending system: on one hand, LRT significantly enhances the capital efficiency of ETH-like assets. It allows assets that could only earn base staking yields to further possess capabilities for lending, leverage, and cross-protocol compositions, thus improving the overall capital utilization in DeFi. On the other hand, LRT also changes the risk landscape of lending protocols. Protocols are no longer only facing ETH price fluctuations; instead, they also have to handle pricing of yield assets, oracle design, liquidity depth, bridging safety, re-staking mechanisms, and liquidation chains. Recent discussions around the rsETH incident have focused on revealing the systemic vulnerability arising from high LTV, bridge risks, and the accumulation of recursive positions.
2. Overview and Analysis of Major LRT Issuers
From 2024 to 2026, the LRT track rapidly transitioned from the proof-of-concept stage to the scaled competitive phase. The entire LRT sector grew from zero to nearly $8 billion in just two years, reflecting the strong pursuit of "capital efficiency" by DeFi users. As of April 23, 2026, according to the latest data from DefiLlama, the total TVL of Liquid Restaking across the sector exceeded $7.8 billion. Among them, ether.fi Stake TVL reached $5.417 billion; Kelp Protocol had a TVL of about $1.608 billion (across 16 chains); Renzo at approximately $399 million; Mantle Restaking at about $175 million. From the market landscape perspective, the LRT sector has formed a clear concentration effect at the top, with the top three protocols occupying the vast majority of market share, while later players primarily seek breakthroughs in segmented scenarios, multi-chain deployment, and differences in risk appetite.
Source: https://defillama.com/protocols/liquid-restaking
When looking at token market capitalization, the concentration at the top is equally evident. As of April 23, 2026, CoinGecko data shows: the market cap of weETH is approximately $5.66 billion, rsETH about $1.3 billion, and ezETH about $439 million.
Source: https://www.coingecko.com/en/categories/liquid-restaking-tokens
This means that the market's pricing of different LRT issuers does not solely depend on the common label of "re-staking" but has begun to differentiate based on protocol scale, liquidity depth, cross-chain design, DeFi integration capabilities, and risk exposure structures. In other words, while LRTs are all superficially "re-staking assets," the quality of the underlying protocols and systemic risks behind them are not the same.
ether.fi: Strongest in Scale, Liquidity and Ecological Integration
In the current LRT market, ether.fi is undoubtedly the most representative leader. Its core products include eETH and weETH: the former is a restaked ETH share that automatically accumulates yield, while the latter is a fixed supply, packaged version suitable for DeFi composition. When users deposit ETH into the protocol, they receive eETH shares, which can further be packaged into weETH to adapt to a wider range of DeFi scenarios. In other words, ether.fi does not only offer a “re-staking token,” but has built a more complete asset form system around different use scenarios.
Overall, ether.fi is closer to a “leader type, stable style” LRT issuer: its core advantage is not extreme yield but large scale, strong liquidity, complete asset forms, high DeFi acceptance, and relatively mature governance and product structures. ether.fi claims its assets have been integrated into over 400 DeFi protocols, including Pendle, Aave, Morpho, Balancer, Aura, Uniswap V3, Convex, etc. This indicates that weETH is not just a passive holding asset but has deeply entered core scenarios like lending, derivatives, LP, and yield aggregation.
Kelp / Kernel DAO: Multi-chain Expansion and Cross-chain Structural Risks
Kelp DAO has currently evolved brand-wise towards Kernel DAO, but its core LRT asset rsETH remains one of the most important head products in the market. DefiLlama data shows Kelp's TVL is around $1.5 billion to $1.6 billion, firmly ranking second in the Liquid Restaking track, with rsETH covering over 10 mainstream L2s and more than 40 DeFi platforms. This indicates that Kelp's core competitiveness is not merely issuing an LRT but extending rsETH as a cross-chain tradeable and cross-protocol combinable universal yield asset as much as possible.
From a business perspective, Kelp focuses more on multi-chain expansion and external integration efficiency than ether.fi. If ether.fi can be seen as building the strongest liquidity center in Ethereum’s home field, Kelp is closer to a strategy of “rapidly laying out a multi-chain circulation network.” This strategy can expand the user base quicker and make it easier for rsETH to enter different lending, liquidity, and incentive scenarios across chains, thus its growth rate was once considerable. CoinGecko data shows that the market cap of rsETH remained around $1.3 billion in late April 2026, indicating that even after experiencing a major security incident, it still maintained a significant volume scale.
However, Kelp's problems lie precisely in this high expansion and high external dependency structure. The massive funds stolen incident concentrated on its rsETH cross-chain configuration adopting a single-DVN structure. Once this part encounters issues, the impact does not just affect liquidity on a single chain, but destabilizes rsETH as the credit foundation of the entire cross-chain asset system.
Renzo: Institutional Positioning and Strategy Abstraction
Compared to ether.fi and Kelp, Renzo is significantly smaller in scale but still maintains a top-tier position. Renzo positions itself as a platform with institutional-level standards and security, emphasizing providing transparent, secure, and controllable advanced yield strategy access for individuals and institutions. This indicates that Renzo attempts to distinguish itself from the "pure retail-driven high-yield narrative," instead presenting itself as a re-staking platform that values strategy management and risk control more.
Renzo's competitiveness is mainly reflected in two areas. First, it emphasizes strategy abstraction capabilities. For ordinary users, the complexity of re-staking does not lie in the step of "depositing ETH" but in managing the underlying nodes, AVS, yield sources, and risk exposures. Renzo hopes to package these complex operations into more standardized products, allowing users to gain re-staking rewards without deeply understanding the underlying mechanisms. Second, it continuously reinforces the narrative of "institutional-level risk control" and "transparency," with related documents explicitly listing risk disclosures, risk mitigations, and operational delays or suspensions if necessary.
In summary, Renzo does not have the scale and liquidity moat of ether.fi, nor the aggressive multi-chain expansion path of Kelp, but emphasizes professionalization and risk control in its product narrative more. This makes it more appealing to some middle-to-high net worth users and institutions, but also means that its growth ceiling largely depends on whether the market continues to value the "institutional-level risk management narrative."
Other Important Players: Mantle, Swell, and LBTC
Besides the top three protocols, Mantle Restaking and Swell Liquid Restaking are also significant representatives in the LRT track. Mantle, supported by Bybit, leans more towards on-chain resource synergy, forming a closed loop relying on specific ecosystems; Swell focuses on its LRT products and related composite scenarios, attempting to capture local market share through differentiated positioning. Their significance lies not in whether they can challenge the leaders in the short term, but in indicating that the LRT track is not only about "scale competition" but also presents paths of ecological binding and vertical breakthroughs.
Another noteworthy player is Lombard's LBTC. Strictly speaking, LBTC belongs to the re-staking/yield-optimized assets in the BTC direction, not to the same sub-category of traditional ETH LRT, but it is highly representative: it shows that the "re-staking + liquidity packaging" model is replicating from ETH to BTC, SOL, and other assets, indicating that the LRT design logic is expanding from "Ethereum yield assets" to a broader "composable yield packaging assets."
Overall, the differences among LRT issuers ultimately return to the same question: how protocols balance capital efficiency, liquidity expansion, and safety boundaries. ether.fi leans towards being a "robust leader," building a moat based on scale, liquidity, and product maturity; Kelp / Kernel DAO is more of an "aggressive expander," with strong multi-chain deployment and DeFi integration capabilities but the complexity of bridging also brings higher structural risks; Renzo is positioned between the two, emphasizing strategy management and institutional risk control, but fundamentally still belongs to the high complexity asset segment of LRT. In the LRT track, no issuer can provide an "absolute safety" commitment; it is only about making more rational choices among different risk structures. Thus, the differences among LRT issuers are not merely product differences but results of the market pricing different risk structures.
3. Review of Typical Risk Events in LRT
Review of the Kelp DAO rsETH Theft Incident
The Kelp DAO rsETH incident on April 18, 2026, is one of the most representative risk events in the LRT track this year, exposing the "composability risks of re-staking assets" in such a concentrated manner for the first time. The attackers contaminated the downstream RPC infrastructure relied on by LayerZero Labs' DVN, and combined with a DDoS attack, forced the system to revert to a manipulated node view, ultimately fabricating a cross-chain message that had never actually occurred. This caused Kelp's cross-chain bridge to erroneously release 116,500 rsETHs, worth about $290 million at the time, approximately 18% of its circulating supply, which should have had a 1:1 mapping to real underlying assets, instantly turning rsETH at the bridging level into a large-scale "unbacked circulating asset."
The most noteworthy aspect of this event is not just the "large stolen amount," but the systemic transmission path, which holds distinct DeFi characteristics. The attackers did not simply choose to dump rsETH, but swiftly deposited these rsETHs without real underlying assets into lending protocols, using them as normal collateral to borrow real assets. As a result, Aave, SparkLend, Fluid, and other protocols were forced to freeze relevant markets to avoid accumulating bad debts. In other words, the attack extended not merely to the “breached bridge,” but along the chain of “fabricated assets - entering lending markets - borrowing real liquidity - leaving bad debt risks,” rapidly spilling over to the entire DeFi credit system. Compared to mere contract vulnerability theft, this type of attack more closely resembles "pushing fake collateral into the financial system and then withdrawing real money from the system." Within two days after the incident, multiple platforms experienced over $13 billion in TVL outflow, showing the market's reaction extended beyond just rsETH itself but rapidly evolved into a risk reassessment of the entire LRT/LST and related lending structures.
Review of the Renzo ezETH Decoupling Incident
Besides Kelp, another earlier but equally representative event was the decoupling of Renzo ezETH in April 2024. Following user dissatisfaction triggered by the REZ token economic model and airdrop allocation, ezETH briefly decoupled from ETH by about 18.3%. This incident was not a hacker attack but a typical chain of "incentive design failure – market confidence damage – liquidity sell-off – price depreciation expansion." It indicates that the risks of LRT do not solely stem from contracts or bridges; at times, protocol incentives, exit expectations, and market sentiment alone can suffice to provoke severe deviations. In comparison to the Kelp incident, the technical destructiveness of the Renzo event was weaker, but it held significant market educational value: the anchoring of LRT depends not only on the underlying assets but also on users' confidence in its redemption logic, token distribution, and future expectations.
Considering these two types of incidents together provides clearer insight into the systematic impacts of LRT risks. Kelp represents a technical failure triggering credit collapse; Renzo represents incentive and sentiment imbalances triggering market sell-offs. Both point to the same conclusion: the high yields of LRT do not exist in isolation but are built on the premise of stable bridging security, lending parameters, liquidity depth, incentive design, and governance expectations. It can be seen that the multi-chain expansion and DeFi nesting of LRT is a double-edged sword, as it enhances capital efficiency while significantly increasing cross-protocol pollution and risk amplification paths. In normal periods, LRT can efficiently circulate between bridges, lending protocols, yield vaults, and derivatives markets, yielding capital efficiency far exceeding that of traditional staking assets; but in extreme cases, this high degree of composability also means that once any link distorts, risks can penetrate downstream at a speed much faster than traditional finance.
4. Disassembling Core Risks of LRT
The expansion of re-staking assets inherently accompanies a simultaneous rise in bridging risks, cross-protocol nesting risks, and systemic correlations. In other words, LRT is not a singular risk asset but a structured yield tool that repackages multiple layers of risks.
1. Technical Risks: This type of risk mainly includes smart contract vulnerabilities, oracle anomalies, and cross-chain risks. The main cause of the KelpDAO incident was that rsETH adopted a single-DVN configuration; attackers forged messages by contaminating the downstream RPC infrastructure, ultimately leading to erroneous asset releases. This indicates that as LRT cross-chain circulation becomes the norm, bridges and validators have transformed from auxiliary modules to parts of the asset credit chain, directly determining whether assets can maintain "trusted anchoring."
2. Economic and Incentive Risks: LRT is not only exposed to ETH price fluctuations but, beyond Ethereum staking yields, also endures risks related to AVS penalties, operator errors, and failures of additional yield mechanisms. Academic research generally finds that the key issue with re-staking mechanisms is not “adding a layer of yield” but “adding a layer of responsibility and sources of losses.” Once issues arise with underlying services, re-staking nodes, or yield distribution logic, the losses incurred by LRT do not remain confined to the protocol but instead reflect directly as price depreciation, user withdrawals, and market repricing.
3. Operational and Governance Risks: Most LRT protocols currently do not genuinely practice full decentralization; critical actions such as pausing, upgrading, adjusting parameters, imposing bridging restrictions, and emergency handling often still rely on multi-signatures from teams or execution by core operational teams. In the Kelp incident, the protocol and related infrastructure responded swiftly within a short period, indicating an improvement in industry's emergency capability; yet this also means many LRT protocols still heavily depend on "human intervention" rather than "protocol self-stability" in extreme situations. This mode is not problematic during normal times, but if the attack speed exceeds the team's response speed, losses are often challenging to completely halt.
4. Liquidity and Structural Risks: These risks are often more concealed than technical issues, as they may not stem from contract breaches but rather from the market losing confidence in the asset. Once LRT encounters significant outflows, liquidity pool imbalances, or deteriorating redemption expectations, it is more prone to price depreciation expansion and acceleration of decoupling. In other words, the stability of LRT not only depends on "theoretically redeemable," but also on "practically having sufficient depth of market support and exit channels."
5. Regulatory and Compliance Risks: As LRT is widely utilized for yield enhancements, lending collateral, and cross-chain circulation, it increasingly approaches an on-chain asset packaging with financial product attributes. Liquidity re-staking and its derivative assets are facing more pronounced regulatory scrutiny, and future developments may affect protocol growth and user liquidity through front-end restrictions, tightening of access in certain regions, increased disclosure requirements, and service provider exits. In other words, the risks of LRT do not only stem from on-chain dynamics but also from its interactions with real-world regulatory frameworks.
It is evident that LRT should not be viewed as an "enhanced version of LST," much less as a passive yield tool that can be left unattended long-term. It resembles a high-complexity leveraged asset that requires continuous monitoring: one must look at both APR and bridging design, liquidity depth, governance transparency, and emergency response capabilities under risk events. LRT offers not risk-free high yields but a simultaneous presence of higher capital efficiency and higher fragility.
5. Insights and Conclusion
The subsequent impacts of the Kelp incident should not just be understood as "one protocol getting damaged." More profound changes lie in that LRT has been re-evaluated by the market within the framework of "infrastructure risk assets" rather than merely as “high-yield assets.” Whether the bridging structure is sufficiently redundant, whether collateral access is too lenient, and whether governance and emergency mechanisms are transparent are becoming new core pricing variables. LayerZero has clearly stated it will no longer sign or validate messages for applications still adopting a 1:1 configuration, while lending scenarios at Aave, Spark, and similar platforms have also become more cautious regarding the risk boundaries of LRT-like assets.
From a risk mitigation perspective, the industry is forming a clearer three-layer response framework:
The first layer is at the protocol level: For LRT issuers, the most important thing is not to continue piling up yields but to first repair the underlying credit structure, including adopting multiple DVN validators, introducing higher redundancy for cross-chain messages, setting time delay withdrawals, increasing circuit breaker mechanisms, and possessing the ability to rapidly freeze high-risk modules in extreme cases. After the Kelp incident, the competition among future LRT protocols will no longer be just APR competition but increasingly resemble "competition in security architecture."
The second layer is at the lending platform level: The reason LRT amplifies risks fundamentally stems from not merely being a yield certificate but being widely absorbed into the lending system, becoming collateral and credit expansion tools. SparkLend's use of Isolation Mode for weETH represents a relatively conservative but pragmatic approach: by imposing debt caps, single collateral restrictions, and constraints on the range of borrowable assets, it aims to contain the external risks of complex assets within a smaller scope. Similarly, more lending protocols are likely to continue adopting isolation modes, dynamic LTVs, segmented market parameters, and more frequent risk reevaluations, rather than simply treating LRT as a "higher-yield LST substitute."
The third layer is at the user level: For ordinary investors, it is essential to understand that LRT is fundamentally a high-complexity, highly compositional yield tool and thus requires more frequent monitoring. What truly matters is not chasing short-term APR but diversifying protocol exposures, controlling leverage, focusing on bridging designs and governance transparency, and incorporating LRT into diversified portfolios rather than treating it as a single concentrated asset.
Changes at the regulatory level will also become an important variable in the next phase of the LRT track. On March 17, 2026, the US SEC, supported by the CFTC, released an explanatory document regarding cryptocurrency assets and related transactions applicable under federal securities laws, clearly incorporating protocol staking and non-security crypto asset packaging into the analytical framework while indicating that some assets may exhibit "mixed characteristics" requiring fact-specific judgment. For LRT, this means that future regulatory focuses may manifest in disclosure obligations, front-end access, service provider compliance, and systemic importance assessments.
Conclusion
LRT represents the latest attempt by DeFi to pursue capital efficiency, but efficiency has never been free. High yields do not merely mean "earning a few more points" but often entail more bridge dependencies, more credit assumptions, and longer risk transmission chains. The LRT track is unlikely to end due to a single incident, but it will enter a stage that emphasizes "safety discount." Bridging standards will likely lean towards more redundant multi-validator structures and more stringent default configurations, lending protocols will conservatively set collateral parameters, and the market will place higher importance on insurance, risk isolation, and emergency response capabilities. The innovative value of LRT still exists, as it indeed enhances the liquidity and capital efficiency of re-staking assets; but in the future, those protocols that can truly navigate cycles will not be the ones with the loudest calls for yields but those that, post-risk events, can still prove that their assets possess verifiable, liquid, and recoverable credit foundations.
About Us
Hotcoin Research, as the core research institution of Hotcoin Exchange, is dedicated to transforming professional analysis into practical tools for you. Through our "Weekly Insights" and "In-depth Reports," we analyze market trends for you; utilizing the exclusive column "Hotcoin Selection" (AI + expert dual filtration), we help you identify potential assets and reduce trial-and-error costs. Each week, our researchers will also face to face with you through live broadcasts to interpret hotspots and predict trends. We believe that warm companionship and professional guidance can assist more investors in navigating through cycles and seizing value opportunities in Web3.
Risk Warning
The cryptocurrency market is highly volatile, and investments carry risks. We strongly recommend that investors invest under a strict risk management framework, only after fully understanding these risks, to ensure the safety of their funds.
Website: https://www.hotcoin.com/zh_CN/learn/index/
免责声明：本文章仅代表作者个人观点，不代表本平台的立场和观点。本文章仅供信息分享，不构成对任何人的任何投资建议。用户与作者之间的任何争议，与本平台无关。如网页中刊载的文章或图片涉及侵权，请提供相关的权利证明和身份证明发送邮件到support@aicoin.com，本平台相关工作人员将会进行核查。
