Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A recent and alarming incident has shaken the DeFi landscape: an attacker has successfully drained a staggering 116,500 rsETH, approximately 18% of the circulating supply, from Kelp DAO's LayerZero-powered bridge, with the stolen funds currently valued at around $292 million. This exploit has triggered a chain reaction of emergency responses across various DeFi platforms, including Aave, SparkLend, and Fluid, which have all frozen their rsETH markets in an effort to mitigate potential losses. The breach occurred at 17:35 UTC on Saturday when the attacker managed to deceive LayerZero's cross-chain messaging layer into releasing the rsETH to an attacker-controlled address. The Kelp DAO's emergency pauser multisig subsequently froze the protocol's core contracts 46 minutes later, at 18:21 UTC, in a bid to prevent further unauthorized transactions. However, two follow-up attempts were made at 18:26 UTC and 18:28 UTC, both of which were successfully reverted, thereby preventing an additional 40,000 rsETH, worth roughly $100 million, from being drained. The rsETH token is deployed across more than 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard facilitating cross-chain movement. As a result of the stolen reserve, holders of wrapped versions of the token on non-Ethereum deployments are now facing uncertainty regarding the underlying value of their tokens, which could lead to a feedback loop of panic redemptions on layer 2 blockchains, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The fallout from this incident is still unfolding, with Aave, SparkLend, and Fluid having already taken measures to freeze rsETH markets, while Lido Finance has paused further deposits into its earnETH product due to its exposure to rsETH. The stablecoin issuer Ethena has also temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp DAO has acknowledged the incident and is currently investigating the matter with LayerZero, Unichain, its auditors, and outside security specialists. The outcome of this investigation and the potential recovery of the stolen funds will be crucial in determining the future of rsETH and the DeFi ecosystem as a whole.