Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Chains Vulnerable

A devastating cyber attack has drained a staggering $292 million from Kelp DAO, a liquid restaking protocol, by exploiting its LayerZero-powered bridge. The breach, which occurred on Saturday at 17:35 UTC, saw 116,500 rsETH (restaked ether) siphoned off, accounting for roughly 18% of the token's total circulating supply. This incident has sent shockwaves throughout the DeFi ecosystem, with far-reaching implications for users and platforms alike. The attack was made possible by tricking LayerZero's cross-chain messaging layer into releasing the funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The stolen rsETH was part of a reserve backing wrapped versions of the token on over 20 networks, including Base, Arbitrum, and Scroll. As a result, holders of rsETH on non-Ethereum deployments are now facing uncertainty about the value of their tokens, potentially triggering a wave of panic redemptions that could put pressure on the unaffected Ethereum supply. The fallout from this incident is still unfolding, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident serves as a stark reminder of the risks and vulnerabilities present in the DeFi space, particularly in the wake of recent exploits, including the $285 million drain from Solana-based perpetuals protocol Drift.