Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A catastrophic breach occurred on Saturday at 17:35 UTC, when an attacker successfully drained 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, valued at around $292 million. This substantial loss accounts for roughly 18% of the total circulating supply of rsETH. The exploited bridge was responsible for holding the rsETH reserve that backed wrapped versions of the token on over 20 different blockchains. The attacker manipulated LayerZero's cross-chain messaging system into releasing the funds to a controlled address. In response, Kelp's emergency pauser multisig froze the core contracts 46 minutes later. However, two subsequent attempts to drain an additional 40,000 rsETH were thwarted. The incident has triggered a wave of panic, with various DeFi platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets. The potential fallout is extensive, with holders of wrapped rsETH on non-Ethereum blockchains facing uncertainty about the value of their tokens. As a result, Kelp may be forced to unwind its restaking positions to honor withdrawals, potentially leading to a broader contagion. The situation is being closely monitored, with many platforms taking precautionary measures to mitigate potential losses.