Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating crypto exploit has occurred, with an attacker successfully draining 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply, from Kelp DAO's LayerZero-powered bridge. The stolen funds, valued at around $292 million, were siphoned off at 17:35 UTC on Saturday, triggering a series of emergency responses across the DeFi landscape. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield on user-deposited ETH, issuing rsETH as a tradeable receipt. The breached bridge held the rsETH reserve backing wrapped versions of the token deployed on over 20 other blockchains, including Base, Arbitrum, and Scroll. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts, while Aave, SparkLend, and Fluid froze their rsETH markets. The incident has sent shockwaves through the DeFi community, with AAVE's price plummeting by around 10% and Lido Finance pausing further deposits into its earnETH product. As the situation continues to unfold, the potential for further contagion and the impact on the DeFi ecosystem remain uncertain.