Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A devastating hack has struck Kelp DAO, a liquid restaking protocol, with an attacker making off with 116,500 rsETH, valued at around $292 million. This significant loss, equivalent to about 18% of the circulating supply, has sent shockwaves throughout the DeFi ecosystem. The breach occurred on Saturday at 17:35 UTC, when the attacker exploited a vulnerability in LayerZero's cross-chain messaging layer, tricking the system into releasing the funds to an attacker-controlled address. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC, in an attempt to mitigate further damage. However, two subsequent attempts by the attacker to drain an additional 40,000 rsETH were thwarted. The stolen rsETH was part of a reserve backing wrapped versions of the token on over 20 other blockchains, leaving holders on non-Ethereum deployments uncertain about the validity of their tokens. This has created a ripple effect, with panic redemptions on layer 2 blockchains potentially forcing Kelp to unwind restaking positions to honor withdrawals. The fallout has been swift, with Aave, SparkLend, and Fluid freezing their rsETH markets, and AAVE's price plummeting by around 10% in response to the potential bad debt. Lido Finance has also paused further deposits into its earnETH product, which carries rsETH exposure, while Ethena has temporarily halted its LayerZero OFT bridges as a precautionary measure. As the investigation into the incident continues, the future of rsETH hangs in the balance, with its peg to ETH uncertain and the potential for further contagion looming large.