Massive Crypto Heist: Kelp DAO Loses $292 Million to Attackers

A devastating cyber attack has drained nearly 18% of the circulating supply of restaked ether tokens, worth around $292 million, from Kelp DAO's LayerZero-powered bridge, triggering a wave of emergency responses throughout the DeFi ecosystem. The attack, which occurred on Saturday at 17:35 UTC, involved the exploitation of LayerZero's cross-chain messaging layer, allowing the perpetrator to trick the system into releasing 116,500 rsETH to an attacker-controlled address. The stolen tokens were part of the reserve backing wrapped versions of rsETH on over 20 other blockchains. In response to the breach, Kelp DAO's emergency pauser multisig froze the protocol's core contracts 46 minutes after the attack, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The fallout from the incident is widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The attack has significant implications for the DeFi space, particularly given the current hostile environment, which has seen numerous smaller protocols exploited in recent weeks. The future of rsETH's peg remains uncertain, dependent on the ability of Kelp to recover the stolen funds and the actions of holders on non-Ethereum deployments.