Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating breach has occurred in the DeFi space, with an attacker successfully siphoning off nearly 18% of the circulating supply of restaked ether tokens from Kelp DAO's LayerZero-powered bridge. The stolen funds, valued at approximately $292 million, have been taken from a reserve that backed wrapped versions of the token on over 20 other blockchains. On Saturday, at 17:35 UTC, an attacker exploited a vulnerability in LayerZero's cross-chain messaging layer to trick Kelp's bridge into releasing 116,500 rsETH to an attacker-controlled address. The breach was only halted 46 minutes later when Kelp's emergency pauser multisig froze the protocol's core contracts. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield on top of standard Ethereum staking rewards, issuing rsETH as a tradeable receipt. However, the drained bridge held the reserve backing wrapped versions of the token on multiple layer 2 blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. The aftermath of the attack has seen a ripple effect throughout the DeFi ecosystem. Aave, SparkLend, and Fluid have all frozen their rsETH markets, while Lido Finance has paused further deposits into its earnETH product due to its exposure to rsETH. Ethena has also temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. The incident is currently under investigation by Kelp, LayerZero, Unichain, and outside security specialists. However, the full extent of the damage and the potential for recovery of the stolen funds remains unclear. The attack has significant implications for the DeFi space, particularly in light of recent exploits targeting other protocols such as Solana-based perpetuals protocol Drift, which was drained of approximately $285 million in an attack linked to North Korea-affiliated actors. As the situation continues to unfold, the DeFi community is left to grapple with the consequences of this massive breach and the potential for further contagion. With the largest DeFi exploit of 2026 now on record, the industry is bracing for a potentially hostile stretch, with many smaller protocols having been exploited in recent weeks.