Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A devastating crypto exploit has occurred, with an attacker successfully draining a substantial amount of rsETH from Kelp DAO's LayerZero-powered bridge, sparking a chain reaction of emergency freezes and pauses across various DeFi platforms. On Saturday, at 17:35 UTC, the attacker managed to trick LayerZero's cross-chain messaging layer into releasing 116,500 rsETH, worth around $292 million, to an attacker-controlled address. This significant breach has raised concerns about the security of DeFi platforms and the potential for further exploits. The Kelp DAO protocol, which allows users to earn additional yield on their ETH deposits through liquid restaking, has been severely impacted by the attack. The stolen rsETH was part of a reserve backing wrapped versions of the token deployed on over 20 other blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. In response to the attack, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain. However, two subsequent attempts to drain an additional 40,000 rsETH were reverted. The attack has sent shockwaves throughout the DeFi community, with Aave, SparkLend, and Fluid freezing their rsETH markets. Lido Finance has also paused further deposits into its earnETH product, which carries rsETH exposure, while Ethena has temporarily paused its LayerZero OFT bridges as a precaution. The incident has sparked concerns about the potential for a broader contagion, with AAVE falling by around 10% as the market prices in potential bad debt. The long list of affected platforms continues to grow, leaving many to wonder about the potential consequences of this massive exploit. As the DeFi community grapples with the aftermath of this attack, Kelp DAO has acknowledged the incident and is investigating the cause with the help of LayerZero, Unichain, its auditors, and outside security specialists. The protocol has not yet disclosed how the exploit bypassed the bridge's validation logic. The coming days will be crucial in determining the fate of rsETH, as the cross-chain float attempts to redeem into ETH on Ethereum. Whether Kelp can recover any portion of the stolen funds remains to be seen, and the Tornado Cash trail is rapidly going cold. This recent attack is the latest in a string of DeFi exploits, including the $285 million heist on Solana-based perpetuals protocol Drift, which was linked to North Korea-affiliated actors. The frequency and severity of these incidents have raised concerns about the security and stability of DeFi platforms.