Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded

A devastating exploit has struck the DeFi world, with an attacker successfully draining nearly 18% of the circulating supply of restaked ether from Kelp DAO's LayerZero-powered bridge, worth approximately $292 million. The incident occurred on Saturday at 17:35 UTC, when the attacker tricked LayerZero's cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. The stolen funds were part of the reserve backing wrapped versions of the token deployed on over 20 other blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. In response to the attack, Kelp DAO's emergency pauser multisig froze the protocol's core contracts, while several other DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets. The fallout from the exploit is ongoing, with the potential for further contagion and a significant impact on the DeFi market. The incident highlights the growing threat of cross-chain bridge exploits and the need for enhanced security measures to protect user funds.