Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A catastrophic breach has occurred in the DeFi sector, with an attacker successfully draining 116,500 rsETH, equivalent to approximately $292 million, from Kelp DAO's LayerZero-powered bridge. This incident, which took place on Saturday at 17:35 UTC, has significant implications for the entire ecosystem. The stolen funds represent roughly 18% of the total circulating supply of rsETH, a restaked ether token. The bridge in question was responsible for holding the rsETH reserve that backed wrapped versions of the token on over 20 different blockchains. The attacker managed to deceive LayerZero's cross-chain messaging layer into releasing the funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC, in an attempt to mitigate the damage. However, two subsequent attempts to drain an additional 40,000 rsETH, worth around $100 million, were made at 18:26 UTC and 18:28 UTC, both of which were reverted. The rsETH token is currently deployed across more than 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard facilitating cross-chain movement. As a result of the drained reserve, holders of wrapped rsETH on non-Ethereum deployments are now facing uncertainty regarding the backing of their tokens. This has created a feedback loop, where panic redemptions on layer 2 blockchains are putting pressure on the unaffected Ethereum supply, potentially forcing Kelp to unwind its restaking positions to honor withdrawals. The fallout from this incident is widespread, with Aave, SparkLend, and Fluid all freezing their rsETH markets. Lido Finance has paused further deposits into its earnETH product, which has exposure to rsETH, and Ethena has temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp has acknowledged the incident and is currently investigating with LayerZero, Unichain, its auditors, and outside security specialists. The ability of rsETH to maintain its peg over the weekend will depend on the extent to which the cross-chain float attempts to redeem into ETH on Ethereum and whether Kelp can recover any portion of the stolen funds before the trail goes cold. This attack is the latest in a series of exploits to hit the DeFi sector, with Solana-based perpetuals protocol Drift being drained of around $285 million on April 1 and at least a dozen smaller protocols being exploited in recent weeks.