Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A catastrophic breach has struck the DeFi world, as an attacker successfully drained nearly $292 million worth of rsETH from Kelp DAO's LayerZero-powered bridge, triggering a chain reaction of emergency freezes and raising concerns about the stability of the ecosystem. The attack, which occurred on Saturday at 17:35 UTC, exploited a vulnerability in LayerZero's cross-chain messaging layer, allowing the perpetrator to trick the system into releasing 116,500 rsETH to a controlled address. The stolen funds represent approximately 18% of the token's circulating supply, leaving the wrapped versions of rsETH on over 20 blockchains without backing. As a result, holders of these tokens are now facing uncertainty about the value of their assets, leading to a potential feedback loop of panic redemptions that could put pressure on the unaffected Ethereum supply. The fallout from the incident has already been felt, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The contagion is expected to spread, with many more platforms potentially affected. The incident is the latest in a series of high-profile DeFi exploits, including the recent attack on Solana-based perpetuals protocol Drift, which lost approximately $285 million. As the DeFi community grapples with the aftermath of this massive heist, the focus is now on Kelp's efforts to recover the stolen funds and prevent further damage to the ecosystem.