Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A recent security breach has left the DeFi community reeling, as a staggering $292 million worth of rsETH was drained from Kelp DAO's LayerZero-powered bridge, sparking a wave of panic and emergency measures across the ecosystem. The attack, which occurred on Saturday at 17:35 UTC, saw 116,500 rsETH stolen, representing roughly 18% of the token's circulating supply. The bridge in question held the rsETH reserve backing wrapped versions of the token deployed on over 20 other blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the stolen funds to an attacker-controlled address. Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The fallout has been swift, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident has also led to a decline in AAVE's value, with the token falling approximately 10% as the market prices in potential bad debt. As the DeFi community grapples with the aftermath of this massive heist, the long-term implications for Kelp DAO, rsETH holders, and the broader ecosystem remain uncertain.