Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A recent and severe attack on a cross-chain bridge has led to the theft of nearly one-fifth of a restaked ether token's circulating supply, with the aftermath spreading rapidly through the DeFi ecosystem. On Saturday, at 17:35 UTC, an attacker successfully drained 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, valued at roughly $292 million at current prices. This represents about 18% of the 630,000 token circulating supply tracked by CoinGecko. The bridge in question held the rsETH reserve that backed wrapped versions of the token deployed on over 20 other blockchains. The attacker exploited LayerZero's cross-chain messaging layer by tricking it into believing a legitimate instruction had been received from another network, resulting in the release of 116,500 rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain. However, two subsequent attempts to drain an additional 40,000 rsETH, worth approximately $100 million, were reverted. The rsETH token is currently deployed across more than 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard facilitating cross-chain movement. With the reserve drained, holders of wrapped tokens on non-Ethereum deployments are now faced with uncertainty regarding the backing of their tokens, potentially triggering a feedback loop of panic redemptions that could pressure the unaffected Ethereum supply and force Kelp to unwind restaking positions to honor withdrawals. The fallout from the exploit has been widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets, and AAVE experiencing a 10% decline as the market accounted for potential bad debt. Lido Finance has paused further deposits into its earnETH product due to rsETH exposure, while Ethena temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp, a product under the KernelDAO umbrella, has acknowledged the incident and is investigating with LayerZero, Unichain, its auditors, and outside security specialists. The ability of rsETH to maintain its peg over the weekend will depend on the extent of cross-chain redemption into ETH on Ethereum and Kelp's capacity to recover any portion of the stolen funds before the trail goes cold. This significant exploit occurs during a particularly challenging period for DeFi, following the $285 million drain of Solana-based perpetuals protocol Drift on April 1, which was later linked to North Korea-affiliated actors, and at least a dozen smaller protocols have been exploited in recent weeks.