Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A recent cybersecurity breach has left the DeFi community reeling, as a staggering $292 million worth of restaked ether (rsETH) was drained from Kelp DAO's LayerZero-powered bridge. The attack, which occurred on Saturday at 17:35 UTC, exploited a vulnerability in the cross-chain messaging layer, allowing the perpetrator to trick the system into releasing 116,500 rsETH to an attacker-controlled address. This significant loss, representing about 18% of the total rsETH circulating supply, has triggered a wave of emergency responses across various DeFi platforms, including Aave, SparkLend, and Fluid, which have frozen their rsETH markets to mitigate potential losses. The incident has also sparked concerns among holders of wrapped rsETH tokens on over 20 blockchains, as the drained reserve backing these tokens has raised questions about their underlying value. As the situation continues to unfold, the DeFi community is bracing for potential contagion, with AAVE's price already experiencing a 10% decline. The list of affected platforms is growing, with Lido Finance, Ethena, and others taking precautionary measures to protect their users. Kelp DAO has acknowledged the incident and is working with LayerZero, Unichain, and security specialists to investigate the exploit and potentially recover the stolen funds.