Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A significant vulnerability in Kelp DAO's LayerZero-powered bridge was exploited on Saturday, allowing an attacker to drain nearly 18% of the circulating supply of restaked ether tokens, worth around $292 million. The breach has sent shockwaves throughout the DeFi ecosystem, prompting emergency actions from various platforms, including Aave, SparkLend, and Fluid, which have frozen their rsETH markets. The attacker manipulated LayerZero's cross-chain messaging layer, tricking it into releasing 116,500 rsETH to a malicious address. Kelp DAO's emergency response team managed to freeze the protocol's core contracts 46 minutes after the attack, preventing further unauthorized transactions. However, the incident has raised concerns about the potential for panic redemptions on layer 2 blockchains, which could lead to a liquidity crisis. The exploit has also sparked a chain reaction, with Lido Finance pausing deposits into its earnETH product and Ethena temporarily halting its LayerZero OFT bridges as a precautionary measure. The aftermath of the attack is still unfolding, with the fate of rsETH's peg and the potential for further contagion hanging in the balance. This incident marks the largest DeFi exploit of 2026, surpassing the recent $285 million heist targeting Solana-based perpetuals protocol Drift.