Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A devastating exploit has struck a cross-chain bridge, draining nearly a fifth of the circulating supply of a restaked ether token and triggering a wave of emergency freezes across the DeFi landscape. On Saturday at 17:35 UTC, an attacker successfully siphoned off 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, worth roughly $292 million at current prices. This significant loss accounts for approximately 18% of the token's 630,000-unit circulating supply tracked by CoinGecko. Kelp DAO, a liquid restaking protocol, utilizes user-deposited ETH to generate additional yield beyond standard Ethereum staking rewards through EigenLayer, issuing rsETH as a tradeable receipt. The drained bridge held the rsETH reserve that backed wrapped versions of the token deployed on more than 20 other blockchains, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, all of which rely on LayerZero's OFT standard for cross-chain movement. The attacker managed to deceive LayerZero's cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address by mimicking a valid instruction from another network. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain. However, two subsequent attempts to drain an additional 40,000 rsETH, valued at approximately $100 million, were reverted. The aftermath of the exploit has created uncertainty for holders of rsETH on non-Ethereum deployments, as the drained reserve backed wrapped versions on every layer 2 blockchain. This has sparked a feedback loop where panic redemptions on these networks could pressure the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The list of affected platforms is extensive and continues to grow, with Aave, SparkLend, and Fluid having already frozen rsETH markets. Aave's founder, Stani Kulechov, confirmed that the exploit was external and did not compromise Aave's contracts. The AAVE token fell by about 10% as the market factored in potential bad debt. Lido Finance has paused further deposits into its earnETH product due to rsETH exposure, while Ethena temporarily halted its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp, operating under the KernelDAO umbrella, acknowledged the incident and is investigating with LayerZero, Unichain, auditors, and outside security specialists. The ability of rsETH to maintain its peg through the weekend hinges on the extent of cross-chain redemption into ETH on Ethereum and Kelp's capacity to recover any portion of the stolen funds before the trail goes cold. This significant hack occurs during a particularly challenging period for DeFi, following a $285 million drain from Solana-based perpetuals protocol Drift on April 1, attributed to North Korea-affiliated actors, and a series of smaller protocol exploits.