On April 19, 2026, Kelp DAO lost $292 million to an exploit attributed to the Lazarus Group. The attack targeted LayerZero bridge infrastructure used by Kelp's rsETH token -- not EigenLayer's core restaking contracts -- but the cascading effects rippled through every restaking token in the market. Aave's total TVL dropped by approximately $6 billion as users rushed to de-risk positions that used rsETH as collateral.
Deep Blue Alpha tracked what happened next across five staking and restaking tokens. The data told a clear story: whales did not abandon the staking category. They rebalanced within it.
The Split in Whale Capital
DBA tracked whale flow on five key tokens over a 30-day window following the exploit:
LDO (Lido) -- 529 tracked whales, 3,761 trades, $66.4 million volume, +$3.0 million net inflow. Whale wallets were building LDO positions at $0.39 while the underlying protocol maintained $38 billion in TVL and a 24.2% staking market share. Lido's V3 modular stVaults upgrade -- giving institutional participants more control -- may have been part of the thesis.
PENDLE -- 494 tracked whales, 3,841 trades, $80.1 million volume, +$3.6 million net inflow. The strongest accumulation of any token in the group. Pendle's yield-tokenization protocol sits at the intersection of staking and DeFi yield -- eETH, stETH, and other staking derivatives are among its most traded assets. The PENDLE whale data showed the highest volume and most trades of any token in the analysis.
EIGEN (EigenLayer) -- 336 tracked whales, 2,499 trades, $28.4 million volume, +$562,300 net inflow. Slight accumulation at the foundational layer. With $8.9 billion in TVL, 1,900+ operators, and $47 million in AVS operator rewards distributed, EIGEN attracted measured conviction rather than high-urgency buying.
ETHFI (ether.fi) -- 278 tracked whales, 1,503 trades, $25.5 million volume, -$5.2 million net outflow. The clear outlier. ETHFI was the most liquid proxy trade for reducing restaking exposure. ether.fi was not directly compromised, but its token absorbed the selling pressure from whales who wanted to de-risk the category quickly.
COMP (Compound) -- 383 tracked whales, 2,560 trades, $48.5 million volume, -$707,600 net outflow. The mildest signal. Included as a DeFi benchmark rather than a restaking-specific data point.
Reading the Pattern
The aggregate flow resolved into a readable signal:
LDO and PENDLE accumulation represented yield-seeking positioning in the staking infrastructure layer. Both tokens benefit from staking and restaking activity regardless of which specific restaking protocol wins. Lido captures the base staking layer. Pendle captures the yield-tokenization layer. Whale wallets positioned in the plumbing that services the category rather than betting on a single protocol.
ETHFI distribution represented exploit risk repricing. When a $292 million exploit hit one restaking protocol, whales did not wait to assess whether their specific protocol was safe. They de-risked the category first. ETHFI was the fastest way to do that -- selling the governance token is quicker and more liquid than unwinding eETH positions through withdrawal queues.
The Macro Staking Picture
The context matters. Approximately 37 million ETH was staked as of May 2026 -- roughly 31% of circulating supply. EigenLayer's restaking ecosystem held $8.9 billion in TVL. And for the first time, institutional capital entered Ethereum staking through regulated wrappers.
BlackRock's ETHB (iShares Ethereum Trust) launched March 12, 2026, drawing $250 million in its first week. The fund stakes an estimated 70-95% of its held ETH through Coinbase Prime, delivering a net yield of roughly 2% after management fees. Fidelity followed with $1.2 billion on day one.
These ETF products created a yield floor for institutional capital. An allocator who can earn 2% net in a regulated, brokerage-accessible ETF has no reason to navigate smart-contract risk for 3.5% -- unless the incremental yield justifies the incremental risk. That competitive pressure matters for the restaking ecosystem.
The Restaking TVL Hierarchy
The liquid restaking protocols built on EigenLayer had their own pecking order:
- ether.fi: $5.2 billion TVL (96% on Ethereum), $50 million buyback approved
- Kelp DAO: $1.3 billion TVL (post-exploit recovery from $1.6B)
- Puffer: $1.26 billion TVL
- Symbiotic: $897 million TVL (down from $2.7B ATH in December 2024)
- Renzo: $217-753 million TVL (range reflects cross-chain bridge migration)
The Kelp exploit specifically demonstrated that restaking risk extends beyond AVS slashing mechanics into bridge infrastructure, oracle dependencies, and cross-chain composability. A restaker holding rsETH was exposed not just to Ethereum validator slashing and EigenLayer AVS slashing, but to LayerZero bridge security -- a dependency most depositors had not priced.
How to Track Whale Capital in Staking
Start with the macro picture on DefiLlama's staking categories for total ETH staked and protocol TVLs. Then monitor restaking token whale flow on Deep Blue Alpha's token pages: /token/LDO, /token/EIGEN, /token/ETHFI, /token/PENDLE.
Compare net flow direction across multiple tokens simultaneously. Category-level signals -- like the post-Kelp ETHFI distribution paired with LDO/PENDLE accumulation -- are more meaningful than single-token noise.
The live whale feed surfaces individual large transactions in real time, and the whale wallet leaderboard reveals multi-token holdings across the staking stack.
Track restaking whale flows live at deepbluealpha.io.
Deep Blue Alpha is an Ethereum whale intelligence platform tracking 10,000+ whale wallets in real time. This article is for informational purposes only and does not constitute financial advice. NFA/DYOR.
Track whale activity for free at deepbluealpha.io
Top comments (0)