Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A recent and severe exploit has struck the cryptocurrency world, as an attacker successfully drained a staggering $292 million from Kelp DAO's LayerZero-powered bridge, which held nearly 18% of the circulating supply of rsETH. The breach occurred on Saturday at 17:35 UTC, with the attacker exploiting a vulnerability in LayerZero's cross-chain messaging layer to trick the bridge into releasing 116,500 rsETH to an attacker-controlled address. The stolen funds were part of the reserve backing wrapped versions of rsETH deployed across more than 20 blockchains. In response to the attack, Kelp DAO's emergency pauser multisig froze the protocol's core contracts 46 minutes later, but not before the attacker made two follow-up attempts to drain an additional 40,000 rsETH. The incident has sent shockwaves throughout the DeFi ecosystem, with several major platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets as a precautionary measure. The attack has also raised concerns about the potential for a broader contagion, as holders of rsETH on non-Ethereum deployments face uncertainty about the value of their tokens. With the fallout still unfolding, the incident has already led to a significant decline in the value of AAVE, with the token falling by around 10% as the market assesses the potential impact of the exploit. As the investigation into the breach continues, the DeFi community remains on high alert, with many protocols taking steps to mitigate potential risks and prevent similar attacks in the future.