Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating exploit has struck the Kelp DAO, a liquid restaking protocol, with an attacker making off with approximately $292 million worth of rsETH, a restaked ether token. The attack, which occurred on Saturday at 17:35 UTC, involved the manipulation of LayerZero's cross-chain messaging layer, tricking the system into releasing 116,500 rsETH to an attacker-controlled address. The stolen funds were part of a reserve backing wrapped versions of the token on over 20 blockchains, including Base, Arbitrum, and Scroll. In response to the attack, Kelp DAO's emergency pauser multisig froze the protocol's core contracts, while other DeFi platforms, such as Aave and SparkLend, have frozen their rsETH markets. The incident has sent shockwaves through the DeFi community, with the potential for widespread contagion and a significant impact on the price of rsETH. As the situation continues to unfold, holders of rsETH on non-Ethereum deployments are left wondering if their tokens are backed by any underlying assets, leading to a potential feedback loop of panic redemptions and further market instability. The attack is the latest in a series of high-profile DeFi exploits, including the recent hack of Solana-based perpetuals protocol Drift, which lost approximately $285 million. With the Kelp DAO exploit now the largest DeFi heist of 2026, the community is on high alert, awaiting further developments and potential measures to mitigate the damage.