Major Crypto Heist: Kelp DAO Loses $292 Million in rsETH to Exploit

A significant attack on Kelp DAO's LayerZero-powered bridge has resulted in the loss of 116,500 rsETH, valued at around $292 million. This represents about 18% of the total rsETH in circulation. The breach occurred when the attacker manipulated LayerZero's cross-chain messaging system, tricking it into releasing the funds to an attacker-controlled address. The aftermath is spreading rapidly through DeFi, with multiple platforms taking emergency measures to freeze related assets. Kelp DAO, a liquid restaking protocol, utilizes user-deposited ETH to generate additional yield and issues rsETH as a tradable receipt. The drained bridge held the rsETH reserve that backed wrapped versions of the token on over 20 other blockchains, raising concerns about the validity of these wrapped tokens. Following the incident, Kelp's emergency pauser multisig froze core contracts, and subsequent attempts by the attacker were thwarted. The exploit's impact is being felt across various DeFi platforms, including Aave, which froze rsETH markets, and Lido Finance, which paused further deposits into its earnETH product due to rsETH exposure. The situation continues to unfold, with the potential for further contagion and the value of rsETH hanging in the balance.