Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A devastating breach has occurred in the cryptocurrency space, with a staggering $292 million worth of restaked ether (rsETH) being drained from Kelp DAO's LayerZero-powered bridge. This incident has sent shockwaves throughout the DeFi ecosystem, as the stolen funds were backed by wrapped versions of the token on over 20 different blockchains. The attack, which took place on Saturday at 17:35 UTC, exploited a vulnerability in LayerZero's cross-chain messaging layer, allowing the perpetrator to trick the system into releasing 116,500 rsETH to an attacker-controlled address. The breach was executed despite the protocol's core contracts being frozen 46 minutes later, at 18:21 UTC, in an attempt to mitigate the damage. The repercussions of this incident are far-reaching, with multiple DeFi platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets in response to the exploit. The AAVE token has also experienced a significant decline in value, plummeting by approximately 10% as the market reacts to the potential bad debt. Lido Finance has paused further deposits into its earnETH product, citing exposure to rsETH, while Ethena has temporarily halted its LayerZero OFT bridges as a precautionary measure. The stablecoin issuer has assured that it has no rsETH exposure and remains over 101% overcollateralized. Kelp DAO, a product under the KernelDAO umbrella, has acknowledged the incident and is currently investigating the breach with LayerZero, Unichain, and outside security specialists. The protocol has not disclosed the details of the exploit or how it bypassed the bridge's validation logic. The fallout from this incident is likely to be significant, with the potential for a feedback loop of panic redemptions on layer 2 blockchains, which could pressure the unaffected Ethereum supply and force Kelp to unwind restaking positions to honor withdrawals. The situation is being closely monitored, and the ability of rsETH to maintain its peg through the weekend remains uncertain. This breach is the latest in a series of high-profile exploits in the DeFi space, including the recent hack of Solana-based perpetuals protocol Drift, which resulted in the loss of approximately $285 million. The Kelp DAO incident is now the largest DeFi exploit of 2026, surpassing the Drift breach by a few million dollars.