Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A catastrophic breach has occurred in the DeFi space, with an attacker successfully siphoning off 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply, from Kelp DAO's LayerZero-powered bridge. The stolen funds, valued at approximately $292 million, have left a trail of vulnerability across over 20 blockchains, where wrapped versions of the token are deployed. The attack, which took place on Saturday at 17:35 UTC, exploited a weakness in LayerZero's cross-chain messaging layer, allowing the attacker to trick the system into releasing the funds to a controlled address. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts 46 minutes later, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The incident has sent shockwaves throughout the DeFi ecosystem, with multiple platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets and Lido Finance pausing further deposits into its earnETH product. As the situation continues to unfold, the fate of rsETH's peg and the potential for further contagion remain uncertain, leaving the DeFi community on high alert.