Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A recent security breach has left a significant portion of the circulating supply of restaked ether tokens vulnerable, as an attacker successfully drained 116,500 rsETH, valued at approximately $292 million, from Kelp DAO's LayerZero-powered bridge. This incident has triggered a wave of emergency responses across various DeFi platforms, including Aave, SparkLend, and Fluid, which have frozen their rsETH markets to mitigate potential losses. The attack, which occurred on Saturday at 17:35 UTC, exploited a vulnerability in LayerZero's cross-chain messaging layer, allowing the attacker to trick the system into releasing the rsETH to an attacker-controlled address. The fallout from this incident is still unfolding, with the potential for widespread contagion and significant financial losses. The affected tokens are deployed across over 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard handling cross-chain movement. As a result, holders of wrapped versions of these tokens on non-Ethereum deployments are facing uncertainty about the value of their holdings, leading to a potential feedback loop of panic redemptions and pressure on the unaffected Ethereum supply. The incident has already led to a 10% decline in AAVE's value, as the market prices in the potential for bad debt. Lido Finance has also paused further deposits into its earnETH product, which carries rsETH exposure, while Ethena has temporarily paused its LayerZero OFT bridges as a precautionary measure. Kelp DAO has acknowledged the incident and is investigating the cause, but the full extent of the damage and the potential for recovery remain uncertain.