Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A significant breach has occurred in the cryptocurrency space, with an attacker successfully draining 116,500 rsETH, valued at around $292 million, from Kelp DAO's LayerZero-powered bridge. This incident, which took place on Saturday at 17:35 UTC, has resulted in the theft of roughly 18% of the circulating supply of rsETH, a restaked ether token tracked by CoinGecko. The exploited bridge held the rsETH reserve that backed wrapped versions of the token on more than 20 other blockchains, including Base, Arbitrum, and Scroll. The attacker manipulated LayerZero's cross-chain messaging layer into releasing the funds to a controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the attack, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The repercussions of this incident are far-reaching, with holders of rsETH on non-Ethereum deployments now facing uncertainty about the value of their tokens. This has created a potential feedback loop where panic redemptions on layer 2 blockchains could pressure the unaffected Ethereum supply, forcing Kelp to unwind restaking positions to honor withdrawals. As a result, several DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets, and AAVE's price has fallen by around 10%. Lido Finance has also paused further deposits into its earnETH product due to its exposure to rsETH. The incident is being investigated by Kelp, LayerZero, and other security specialists, with the goal of recovering the stolen funds and determining how the exploit bypassed the bridge's validation logic. The success of these efforts will be crucial in maintaining the peg of rsETH over the weekend and preventing further contagion in the DeFi space.