Crypto Market Rocked: $292 Million Stolen from Kelp DAO in Major Exploit

A significant breach occurred on Saturday, with an attacker successfully draining nearly 18% of the circulating supply of restaked ether tokens from Kelp DAO's LayerZero-powered bridge, sparking a series of emergency contract freezes across various DeFi platforms, including Aave, SparkLend, and Fluid. The incident involved the exploitation of LayerZero's cross-chain messaging layer, which allowed the attacker to trick the system into releasing 116,500 rsETH to a controlled address, worth roughly $292 million at current prices. As a result, Kelp DAO's emergency pauser multisig was triggered, freezing the protocol's core contracts 46 minutes after the initial drain, followed by two unsuccessful attempts to drain an additional 40,000 rsETH. The stolen rsETH was part of a reserve backing wrapped versions of the token on over 20 other blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens and potentially triggering a wave of panic redemptions. The fallout from the exploit has been widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets, while Lido Finance has paused further deposits into its earnETH product due to its exposure to rsETH. The incident has raised concerns about the potential for contagion and the impact on the DeFi market as a whole, particularly given the current hostile environment for DeFi, with several smaller protocols having been exploited in recent weeks. Kelp DAO has acknowledged the incident and is investigating the exploit with the assistance of LayerZero, Unichain, and outside security specialists, but the full extent of the damage and the potential for recovery remain to be seen.