Crypto's Biggest Heist of 2026: Kelp DAO Loses $292 Million to Hackers

A devastating breach has struck the DeFi world, as an attacker successfully drained a staggering 116,500 rsETH, valued at around $292 million, from Kelp DAO's LayerZero-powered bridge. The incident, which occurred on Saturday at 17:35 UTC, has sent shockwaves throughout the cryptocurrency ecosystem. The attacker exploited a vulnerability in LayerZero's cross-chain messaging layer, tricking it into releasing the funds to an attacker-controlled address. The fallout from this has been immediate, with Kelp's emergency pauser multisig freezing the protocol's core contracts just 46 minutes later. However, the attacker made two follow-up attempts to drain an additional 40,000 rsETH, both of which were reverted. The breach has significant implications for holders of rsETH, which is deployed across over 20 networks, including Base, Arbitrum, and Scroll. With the reserve backing wrapped versions of the token now depleted, holders on non-Ethereum deployments face uncertainty over the value of their tokens, potentially triggering a wave of panic redemptions. This, in turn, could pressure the unaffected Ethereum supply, forcing Kelp to unwind restaking positions to honor withdrawals. The incident has already had a ripple effect, with Aave, SparkLend, and Fluid freezing their rsETH markets, and AAVE's price plummeting by around 10% as the market reacts to the potential bad debt. Lido Finance has also paused further deposits into its earnETH product, which carries rsETH exposure, while Ethena has temporarily halted its LayerZero OFT bridges as a precautionary measure. Kelp, a product under the KernelDAO umbrella, has acknowledged the incident and is investigating the breach with LayerZero, Unichain, its auditors, and outside security specialists. The coming days will be crucial in determining whether rsETH can maintain its peg, as the cross-chain float attempts to redeem into ETH on Ethereum, and Kelp works to recover any portion of the stolen funds before the trail goes cold. This latest attack is part of an unusually hostile stretch for DeFi, following a string of smaller exploits in recent weeks, including CoW Swap, Zerion, Rhea Finance, and Silo Finance, as well as the $285 million breach of Solana-based perpetuals protocol Drift on April 1.