Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A recent and severe security breach has left the DeFi community reeling, as a staggering 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply, was drained from Kelp DAO's LayerZero-powered bridge. The attack, which occurred on Saturday at 17:35 UTC, has sparked a chain reaction of emergency responses across various platforms, including Aave, SparkLend, and Fluid, in an effort to mitigate the damage. The breach has raised concerns about the stability of wrapped versions of rsETH deployed across over 20 blockchains, as the reserve backing these tokens has been severely depleted. As a result, holders of rsETH on non-Ethereum deployments are facing uncertainty about the value of their tokens, leading to a potential feedback loop of panic redemptions that could further destabilize the market. The fallout from this incident is still unfolding, with several major players in the DeFi space taking precautionary measures to protect their users and assets. Aave has frozen rsETH markets on V3 and V4, while SparkLend and Fluid have also suspended their rsETH markets. The incident has already had a significant impact on the market, with AAVE experiencing a 10% decline in value. Lido Finance has paused further deposits into its earnETH product, citing rsETH exposure, and Ethena has temporarily halted its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp DAO has acknowledged the incident and is currently investigating the matter with the assistance of LayerZero, Unichain, and outside security specialists. The outcome of this incident remains uncertain, with the potential for further market volatility and destabilization in the coming days.