Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A catastrophic breach of a cross-chain bridge has left a trail of destruction in its wake, with nearly 18% of the circulating supply of restaked ether tokens being drained in a matter of minutes. The attack, which occurred on Saturday at 17:35 UTC, saw an attacker exploit a vulnerability in LayerZero's cross-chain messaging layer to trick Kelp DAO's bridge into releasing 116,500 rsETH to a malicious address. The stolen tokens, worth around $292 million, were part of a reserve backing wrapped versions of the token on over 20 different blockchains. The fallout from the attack has been swift, with multiple DeFi platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets in response to the exploit. The incident has also sparked concerns about the potential for a broader contagion, as holders of wrapped rsETH tokens on non-Ethereum deployments face uncertainty over the value of their assets. With the attacker's identity and methods still unknown, the DeFi community is left to ponder the implications of this massive heist, which has already led to a significant decline in the value of AAVE and prompted a precautionary pause in LayerZero OFT bridges by Ethena. As the investigation into the attack continues, one thing is clear: the $292 million loss suffered by Kelp DAO is the largest DeFi exploit of 2026, and its repercussions will be felt throughout the industry for some time to come.