Kelp DAO Suffers Massive $292 Million Crypto Heist, Leaving 20 Blockchains Exposed

A recent security breach has left a significant portion of the circulating supply of restaked ether tokens vulnerable, as an attacker successfully exploited Kelp DAO's LayerZero-powered bridge, draining nearly 18% of the total rsETH supply. The incident occurred on Saturday at 17:35 UTC, with the attacker managing to trick the cross-chain messaging layer into releasing 116,500 rsETH to a controlled address. The stolen funds, worth roughly $292 million, were part of the reserve backing wrapped versions of the token deployed across more than 20 blockchains, including Base, Arbitrum, and Scroll. In response to the attack, Kelp DAO's emergency pauser multisig froze the protocol's core contracts, while other DeFi platforms, such as Aave and SparkLend, have frozen their rsETH markets to mitigate potential losses. The fallout from the exploit is still unfolding, with the value of AAVE plummeting by around 10% and Lido Finance pausing further deposits into its earnETH product. As the situation continues to develop, the long-term implications for the DeFi ecosystem remain uncertain, with the potential for widespread contagion and financial losses.