Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A critical vulnerability in a cross-chain bridge has led to the theft of nearly 18% of the circulating supply of restaked ether, sparking widespread disruptions across the DeFi ecosystem. On Saturday, at 17:35 UTC, an attacker exploited a weakness in Kelp DAO's LayerZero-powered bridge, siphoning off 116,500 rsETH, worth around $292 million. This substantial loss has sent shockwaves throughout the industry, with numerous platforms, including Aave, SparkLend, and Fluid, swiftly freezing their rsETH markets in response. The attacker manipulated LayerZero's cross-chain messaging layer, deceiving it into releasing the stolen funds to an attacker-controlled address. Kelp DAO's emergency response team managed to freeze the protocol's core contracts 46 minutes later, but not before the attacker attempted two additional, unsuccessful drain attempts. The stolen rsETH was part of a reserve backing wrapped versions of the token on over 20 other blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. As the situation unfolds, the DeFi community is bracing for potential contagion, with AAVE's price plummeting around 10% and Lido Finance pausing further deposits into its earnETH product. The incident is currently under investigation, with Kelp DAO working closely with LayerZero, Unichain, auditors, and security specialists to determine the root cause of the exploit and potentially recover the stolen funds.