Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A devastating hack has struck the DeFi world, with nearly 18% of the circulating supply of restaked ether (rsETH) being drained from Kelp DAO's cross-chain bridge, sparking a wave of panic and emergency freezes across multiple platforms. On Saturday at 17:35 UTC, an attacker exploited Kelp DAO's bridge, which utilizes LayerZero's cross-chain messaging technology, to steal 116,500 rsETH, worth around $292 million at current prices. This significant loss accounts for roughly 18% of the total 630,000 rsETH in circulation, as tracked by CoinGecko. Kelp DAO operates as a liquid restaking protocol, where user-deposited ETH is channeled through EigenLayer to generate additional yield beyond standard Ethereum staking rewards, with rsETH serving as a tradable receipt for these deposits. The compromised bridge held the rsETH reserve that backed wrapped versions of the token deployed across more than 20 other blockchain networks. The attacker successfully deceived LayerZero's cross-chain messaging system into validating a fake instruction from another network, resulting in the release of 116,500 rsETH to an attacker-controlled address. In response to the attack, Kelp's emergency pauser multisig froze the protocol's core contracts at 18:21 UTC, 46 minutes after the successful drain. However, two subsequent attempts at 18:26 UTC and 18:28 UTC to drain an additional 40,000 rsETH (valued at approximately $100 million) were thwarted, with each carrying the same LayerZero packet. The stolen rsETH was part of a reserve backing wrapped versions of the token on multiple layer 2 blockchains, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, which rely on LayerZero's OFT standard for cross-chain transactions. With the reserve depleted, holders of wrapped rsETH on non-Ethereum deployments are now faced with uncertainty regarding the backing of their tokens, potentially triggering a panic-driven redemption cycle. This, in turn, could pressure the unaffected Ethereum supply of rsETH, forcing Kelp to unwind its restaking positions to fulfill withdrawal requests. The repercussions of this exploit are far-reaching, with Aave, SparkLend, and Fluid already freezing their rsETH markets in response. AAVE's price plummeted by about 10% as the market factored in potential bad debt. Lido Finance has temporarily halted further deposits into its earnETH product due to its exposure to rsETH, while emphasizing that stETH and wstETH remain unaffected and the core Lido staking protocol is not involved in the incident. Ethena has also taken precautionary measures by pausing its LayerZero OFT bridges from the Ethereum mainnet for approximately six hours to identify the root cause, stating it has no exposure to rsETH and maintains over 101% overcollateralization. Kelp DAO, operating under the KernelDAO umbrella, publicly acknowledged the incident on X at 20:10 UTC, nearly three hours after the attack, and is currently investigating the matter with LayerZero, Unichain, its auditors, and external security experts. The protocol has not yet disclosed how the exploit managed to bypass the bridge's validation logic. The ability of rsETH to maintain its peg over the weekend hinges on the extent of cross-chain redemptions into ETH on the Ethereum network and Kelp's capacity to recover any portion of the stolen funds before the trail goes cold. This significant hack occurs during a particularly challenging period for DeFi, following the $285 million drain of Solana-based perpetuals protocol Drift on April 1, which was later linked to North Korea-affiliated actors. At least a dozen smaller protocols have been exploited in recent weeks, including CoW Swap, Zerion, Rhea Finance, and Silo Finance. The $292 million loss suffered by Kelp DAO now stands as the largest DeFi exploit of 2026, surpassing the Drift incident by a few million dollars.