Lido’s $3M First-Loss Buffer Faces Its First Real Test After Kelp Security Breach

A security incident at Kelp, a liquid restaking protocol, has sent ripple effects through decentralised finance, catching one of Lido Finance’s yield vaults in the crossfire. Lido has paused deposits and withdrawals on its EarnETH vault while it works through two separate but connected problems: direct exposure to a compromised asset and a liquidity squeeze spreading across lending markets.

The Exposure

Of Lido’s EarnETH vault, roughly 9% of total assets are tied to rsETH, the token at the centre of the Kelp incident. That is not a majority stake, but it is enough to trigger a pause while curators work out exactly how much, if any, has been lost.

The Arbitrum Security Council has already recovered around $70 million in ETH connected to the attack. Further recovery efforts are ongoing, but the final accounting on losses has not yet been settled.

A Second Problem: The Lending Crunch

Beyond the rsETH exposure, EarnETH is also dealing with a separate headache. Elevated borrowing rates across lending markets have put pressure on looping strategies inside the vault that have nothing to do with Kelp. Vault curators have been actively deleveraging those positions, and Lido says fast action has already achieved a significant reduction in outstanding wETH debt. A fuller update on progress is expected shortly.

The Safety Net Gets Tested

If losses are confirmed when the dust settles, Lido has a mechanism ready. The Lido DAO treasury holds a $3 million first-loss position inside the EarnETH vault, put there specifically for situations like this one. Under the protection mechanism, the DAO’s vault shares would be burned to absorb losses before ordinary depositors feel the pain, effectively using treasury funds as a buffer.

The arrangement was approved by Lido’s governance earlier this year as part of a broader push to make the Earn product credible enough to scale. Monday’s events are its first real test.

What It Means

DeFi’s interconnected architecture means a single protocol breach can travel fast and far. The Kelp incident has now touched lending market liquidity, restaking tokens, and yield vault strategies across multiple platforms simultaneously.

For Lido, the immediate priority is containing the damage and restoring normal vault operations. For the broader market, it is a reminder that yield in decentralised finance rarely comes without strings attached.