Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

In a shocking turn of events, a hacker successfully drained 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, equivalent to approximately 18% of the token's circulating supply. The attack, which occurred on Saturday at 17:35 UTC, has sent ripples throughout the DeFi ecosystem, prompting swift action from affected platforms. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield for users, issuing rsETH as a tradeable receipt. However, the bridge in question held the rsETH reserve backing wrapped versions of the token on over 20 blockchains, leaving holders on non-Ethereum deployments uncertain about the validity of their tokens. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts, but not before the attacker attempted two follow-up drain attempts. The fallout is being felt across the DeFi landscape, with Aave, SparkLend, and Fluid freezing rsETH markets, and Lido Finance pausing further deposits into its earnETH product. As the situation continues to unfold, the potential for further contagion remains high, with the market already pricing in potential bad debt. The incident serves as a stark reminder of the risks and vulnerabilities present in the DeFi space, particularly in the context of cross-chain bridges and liquid staking protocols.