Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A devastating exploit has struck the cryptocurrency world, with a staggering $292 million worth of restaked ether (rsETH) being drained from Kelp DAO's cross-chain bridge. The attack, which occurred on Saturday at 17:35 UTC, involved the theft of 116,500 rsETH, representing roughly 18% of the token's circulating supply. The bridge in question, powered by LayerZero, held the rsETH reserve that backed wrapped versions of the token on over 20 different blockchains. The attacker successfully tricked LayerZero's cross-chain messaging layer into releasing the rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the attack, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The implications of this exploit are far-reaching, with holders of rsETH on non-Ethereum deployments facing uncertainty over the value of their tokens. This has created a ripple effect, with panic redemptions on layer 2 blockchains potentially forcing Kelp to unwind restaking positions to honor withdrawals. The fallout has already been felt, with Aave, SparkLend, and Fluid freezing their rsETH markets, and AAVE's price plummeting by around 10%. Lido Finance has also paused further deposits into its earnETH product, which carries rsETH exposure, while Ethena has temporarily paused its LayerZero OFT bridges as a precaution. The incident is still being investigated, with Kelp working with LayerZero, Unichain, and outside security specialists to determine the cause of the exploit and recover the stolen funds. The success of these efforts will be crucial in determining whether rsETH can maintain its peg over the weekend.