Crypto's Biggest Heist of 2026: Kelp DAO Loses $292 Million to Hackers

A devastating cyber attack has struck Kelp DAO, a liquid restaking protocol, resulting in the theft of 116,500 rsETH, valued at approximately $292 million. The breach, which occurred on Saturday at 17:35 UTC, exploited a vulnerability in the protocol's LayerZero-powered bridge, allowing the attacker to trick the system into releasing the funds to an unauthorized address. The stolen rsETH, which accounts for roughly 18% of the token's circulating supply, was part of a reserve backing wrapped versions of the token deployed across more than 20 other blockchains. In response to the attack, Kelp DAO's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC. However, two subsequent attempts by the attacker to drain an additional 40,000 rsETH, worth around $100 million, were thwarted. The incident has sent shockwaves through the DeFi community, with several major platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets in response. The attack has also raised concerns about the potential for a broader contagion, as holders of rsETH on non-Ethereum deployments face uncertainty about the value of their tokens. With the contagion list continuing to grow, the incident is likely to have far-reaching implications for the DeFi sector.