Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

In a devastating blow to the DeFi ecosystem, an attacker successfully exploited a vulnerability in Kelp DAO's LayerZero-powered bridge, siphoning off 116,500 rsETH tokens valued at around $292 million. The breach, which occurred on Saturday at 17:35 UTC, has sent shockwaves throughout the cryptocurrency market, with several major platforms scrambling to respond to the crisis. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield on user-deposited ETH, issuing rsETH tokens as a tradeable receipt. The compromised bridge held the rsETH reserve that backed wrapped versions of the token on over 20 other blockchains. By deceiving LayerZero's cross-chain messaging layer into accepting a fraudulent instruction, the attacker managed to trick the bridge into releasing the stolen tokens to a controlled address. In the aftermath, Kelp's emergency pauser multisig intervened, freezing the protocol's core contracts 46 minutes later. However, two subsequent attempts to drain an additional 40,000 rsETH tokens were thwarted. The incident has significant implications for holders of rsETH on non-Ethereum deployments, as the drained reserve has raised concerns about the tokens' underlying value. This has created a ripple effect, with panic redemptions on layer 2 blockchains potentially forcing Kelp to unwind restaking positions to honor withdrawals. In response to the exploit, several prominent DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets. Aave's founder, Stani Kulechov, confirmed that the exploit was external and did not compromise Aave's contracts. Lido Finance has paused further deposits into its earnETH product, citing rsETH exposure, while Ethena has temporarily halted its LayerZero OFT bridges as a precautionary measure. As the situation continues to unfold, the DeFi community is left to grapple with the consequences of this massive heist, which has highlighted the vulnerabilities of cross-chain bridges and the importance of robust security measures. With the contagion list still growing, the coming days will be crucial in determining the fate of rsETH and the broader DeFi ecosystem.