2026's Largest Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating attack has struck the Kelp DAO, a liquid restaking protocol, resulting in the theft of 116,500 rsETH, valued at roughly $292 million. This exploit, which took place on Saturday at 17:35 UTC, has sent shockwaves through the DeFi ecosystem, with the attacker manipulating LayerZero's cross-chain messaging layer to trick the bridge into releasing the stolen funds. The Kelp DAO's emergency response team froze the protocol's core contracts 46 minutes later, but not before the attacker made two follow-up attempts to drain an additional 40,000 rsETH. The breach has left holders of rsETH on over 20 networks, including Base, Arbitrum, and Scroll, uncertain about the value of their tokens, as the reserve backing the wrapped versions has been depleted. This has created a ripple effect, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident is being investigated by Kelp, LayerZero, and outside security specialists, with the protocol acknowledging the breach on social media nearly three hours after the attack. As the DeFi community reels from this massive exploit, concerns are growing about the potential for further contagion and the impact on the overall market.