2026's Largest Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A catastrophic breach has occurred in the DeFi space, as an attacker successfully drained 116,500 rsETH, equivalent to approximately 18% of the circulating supply, from Kelp DAO's LayerZero-powered bridge. The exploit, which took place on Saturday at 17:35 UTC, has sent shockwaves throughout the cryptocurrency market, with the stolen funds valued at around $292 million. The breach has also raised concerns about the stability of wrapped versions of the token deployed across more than 20 other blockchains, including Base, Arbitrum, and Linea. The attacker manipulated LayerZero's cross-chain messaging layer, tricking it into releasing the rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The incident has sparked a wave of panic redemptions, with Aave, SparkLend, and Fluid freezing their rsETH markets, and AAVE's price plummeting by around 10%. Lido Finance has also paused further deposits into its earnETH product, citing rsETH exposure. As the situation continues to unfold, the DeFi community is left to ponder the potential consequences of this massive exploit, including the risk of further contagion and the potential for a broader market downturn.