Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A significant security breach occurred on Saturday, with an attacker draining nearly 18% of the circulating supply of rsETH from Kelp DAO's LayerZero-powered bridge, valued at around $292 million. The stolen funds were held in a cross-chain bridge that backed wrapped versions of the token on over 20 different blockchains, putting the entire DeFi ecosystem at risk. The attacker exploited LayerZero's cross-chain messaging layer by tricking it into releasing 116,500 rsETH to an attacker-controlled address. Following the incident, Kelp's emergency pauser multisig froze the protocol's core contracts, and several DeFi platforms, including Aave, SparkLend, and Fluid, froze their rsETH markets. The exploit has raised concerns about the potential for panic redemptions on layer 2 blockchains, which could pressure the unaffected Ethereum supply and force Kelp to unwind its restaking positions. The fallout from the incident is still unfolding, with several platforms taking precautionary measures to mitigate potential losses. The attack is the largest DeFi exploit of 2026, surpassing the recent $285 million drain from Solana-based perpetuals protocol Drift.