Major Crypto Heist: Kelp DAO Loses $292 Million to Exploit, Affecting 20 Blockchains

A significant vulnerability has been exposed in a cross-chain bridge, leading to the theft of nearly 18% of the circulating supply of restaked ether tokens. On Saturday, an attacker drained 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, valued at approximately $292 million. This incident has sent shockwaves through the DeFi community, prompting several platforms to take emergency measures to mitigate potential losses. The attack occurred when the perpetrator tricked LayerZero's messaging layer into releasing the rsETH to an attacker-controlled address. Following the incident, Kelp's emergency pauser multisig froze the protocol's core contracts, while other platforms such as Aave, SparkLend, and Fluid have frozen their rsETH markets. The fallout from this incident is still unfolding, with potential implications for the stability of the DeFi ecosystem. The exploit has raised concerns among holders of wrapped versions of the token on various blockchains, who may face uncertainty regarding the backing of their tokens. As a result, there is a growing risk of panic redemptions, which could put pressure on the unaffected Ethereum supply and force Kelp to unwind its restaking positions to honor withdrawals. The incident has already led to significant market volatility, with AAVE experiencing a 10% decline. Several other platforms, including Lido Finance and Ethena, have taken precautionary measures to protect their users. Kelp has acknowledged the incident and is working with LayerZero, Unichain, and security specialists to investigate the cause of the exploit. The outcome of this incident will depend on Kelp's ability to recover the stolen funds and restore confidence in the DeFi ecosystem.