Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Chains with Stranded Wrapped Ether

A significant breach occurred in a cross-chain bridge, resulting in the loss of nearly 18% of the circulating supply of a restaked ether token. The incident involved the theft of 116,500 rsETH from Kelp DAO's bridge, which was worth around $292 million at current prices. This bridge utilizes LayerZero, a cross-chain messaging layer that enables verified instructions to be sent between different blockchains. Kelp DAO is a liquid restaking protocol that takes user-deposited ETH, routes it through EigenLayer to generate additional yield, and issues rsETH as a tradeable receipt. The stolen funds were part of a reserve backing wrapped versions of the token deployed across more than 20 other blockchains. The attacker exploited LayerZero's messaging layer, tricking it into releasing the funds to an attacker-controlled address. Following the incident, Kelp's emergency pauser multisig froze the protocol's core contracts, and several DeFi platforms, including Aave, SparkLend, and Fluid, froze their rsETH markets. The aftermath of the attack has raised concerns about the potential for panic redemptions and the pressure on the unaffected Ethereum supply, which could force Kelp to unwind its restaking positions to honor withdrawals. The incident has also led to a significant decline in AAVE's value, with the token falling by about 10% as the market priced in potential bad debt. Other protocols, such as Lido Finance and Ethena, have taken precautionary measures, including pausing deposits and bridges, to mitigate potential risks. The hack has highlighted the vulnerabilities in DeFi and the need for enhanced security measures to protect users' funds.