Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A catastrophic breach has occurred in the DeFi space, as an attacker successfully drained nearly 18% of the circulating supply of restaked ether tokens from Kelp DAO's LayerZero-powered bridge. The incident, which happened on Saturday at 17:35 UTC, saw the theft of 116,500 rsETH, valued at around $292 million at current prices. This significant loss has sent shockwaves throughout the DeFi ecosystem, with several major platforms, including Aave, SparkLend, and Fluid, being forced to freeze their rsETH markets in response to the attack. The hack has also raised concerns about the potential for a broader contagion, as the stolen tokens were held in a reserve backing wrapped versions of rsETH on over 20 different blockchains. The attacker exploited a vulnerability in LayerZero's cross-chain messaging layer, tricking it into releasing the funds to an attacker-controlled address. Kelp DAO's emergency response team managed to freeze the protocol's core contracts 46 minutes after the attack, but not before the attacker made two follow-up attempts to drain an additional 40,000 rsETH. The aftermath of the attack has seen a number of DeFi platforms taking precautionary measures, including Lido Finance, which has paused further deposits into its earnETH product, and Ethena, which has temporarily halted its LayerZero OFT bridges as a precaution. The incident is the latest in a series of high-profile attacks on DeFi protocols, including the recent breach of Solana-based perpetuals protocol Drift, which lost approximately $285 million. As the DeFi space continues to grapple with the fallout from this attack, the coming days will be crucial in determining the extent of the damage and the potential for recovery.