Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A catastrophic breach has occurred in the DeFi space, as an attacker successfully drained nearly a fifth of the circulating supply of a restaked ether token from a cross-chain bridge, triggering a wave of emergency measures across the ecosystem. On Saturday at 17:35 UTC, an attacker exploited Kelp DAO's LayerZero-powered bridge, making off with 116,500 rsETH, valued at approximately $292 million, and representing around 18% of the token's circulating supply. This bridge, which utilizes LayerZero's cross-chain messaging layer, held the rsETH reserve that backed wrapped versions of the token deployed on over 20 other blockchains. The attacker manipulated LayerZero's messaging layer into releasing the rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC, but not before two follow-up attempts to drain an additional 40,000 rsETH. The attack has significant implications for the DeFi space, particularly for holders of rsETH on non-Ethereum deployments, who now face uncertainty regarding the value of their tokens. The fallout from the attack has already begun, with Aave, SparkLend, and Fluid freezing their rsETH markets, and AAVE's price dropping by around 10%. Lido Finance has paused further deposits into its earnETH product, while Ethena has temporarily halted its LayerZero OFT bridges as a precautionary measure. The incident is currently under investigation by Kelp, LayerZero, and other relevant parties, with the goal of recovering the stolen funds and determining the cause of the exploit.