Crypto's Biggest Heist of 2026: Kelp DAO Loses $292 Million to Hackers

In a devastating blow to the cryptocurrency world, a hacker has successfully drained $292 million from Kelp DAO, a liquid restaking protocol, by exploiting a weakness in its LayerZero-powered bridge. The attack, which occurred on Saturday at 17:35 UTC, saw the thief make off with 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply. The breach has sent shockwaves throughout the DeFi ecosystem, with several major protocols, including Aave, SparkLend, and Fluid, rushing to freeze their rsETH markets in response to the incident. The attacker's method involved deceiving LayerZero's cross-chain messaging layer into releasing the stolen funds to an attacker-controlled address. Kelp DAO's emergency response team sprang into action, freezing the protocol's core contracts just 46 minutes after the attack, but not before the thief had attempted two further, unsuccessful withdrawals. The incident has significant implications for holders of wrapped rsETH on over 20 other blockchains, who now face uncertainty over the value of their tokens. As the situation continues to unfold, the cryptocurrency community is left reeling from the largest DeFi exploit of 2026, with many wondering how such a catastrophic breach could have occurred and what the long-term consequences will be for the affected protocols and their users.