Hacker Steals $292 Million from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating hack has struck Kelp DAO, a liquid restaking protocol, with the attacker making off with 116,500 rsETH, valued at around $292 million. The breach occurred on Saturday at 17:35 UTC, when the attacker tricked LayerZero's cross-chain messaging layer into releasing the funds to a controlled address. As a result, the protocol's core contracts were frozen 46 minutes later in an attempt to mitigate the damage. The attack has sent shockwaves through the DeFi community, with several platforms, including Aave and Lido Finance, taking precautionary measures to protect their users. The stolen rsETH was held in a bridge that backed wrapped versions of the token on over 20 blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. With the reserve drained, a feedback loop of panic redemptions on layer 2 blockchains may put pressure on the unaffected Ethereum supply, potentially forcing Kelp to unwind its restaking positions to honor withdrawals. The incident has sparked a wave of freezing and pausing across various DeFi platforms, including Aave, SparkLend, and Fluid, as they attempt to contain the fallout. The attack is the largest DeFi exploit of 2026, surpassing the recent hack of Solana-based perpetuals protocol Drift, which lost around $285 million.