Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A significant breach occurred in the DeFi space when an attacker exploited a vulnerability in Kelp DAO's LayerZero-powered bridge, siphoning off nearly 18% of the circulating supply of restaked ether tokens. The incident, which took place on Saturday at 17:35 UTC, involved the theft of 116,500 rsETH, equivalent to roughly $292 million at current market prices. This substantial loss has triggered a series of emergency responses across various DeFi platforms, including Aave, SparkLend, and Fluid, which have frozen their rsETH markets to mitigate potential damage. The attacker manipulated LayerZero's cross-chain messaging layer, deceiving it into releasing the rsETH to an attacker-controlled address. Following the successful heist, Kelp's emergency pauser multisig intervened, freezing the protocol's core contracts 46 minutes later. However, two subsequent attempts by the attacker to drain an additional 40,000 rsETH were thwarted. The stolen rsETH was part of a reserve backing wrapped versions of the token on over 20 blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. As a result, a potential feedback loop of panic redemptions on layer 2 blockchains may pressure the unaffected Ethereum supply, forcing Kelp to unwind its restaking positions to honor withdrawals. The far-reaching consequences of this exploit have already led to Aave, SparkLend, and Fluid freezing their rsETH markets, with AAVE experiencing a 10% decline in value. Lido Finance has also paused further deposits into its earnETH product due to its exposure to rsETH. The incident is still unfolding, with Kelp acknowledging the breach and collaborating with LayerZero, Unichain, auditors, and security specialists to investigate and potentially recover the stolen funds.