Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A recent and severe security breach has left a significant portion of the circulating supply of restaked ether tokens vulnerable, as an attacker successfully drained nearly $292 million worth of rsETH from Kelp DAO's LayerZero-powered bridge. The incident, which occurred on Saturday at 17:35 UTC, involved the theft of 116,500 rsETH, roughly 18% of the token's total supply. This cross-chain bridge played a crucial role in holding the rsETH reserve that backed wrapped versions of the token deployed across more than 20 other blockchains. The attacker exploited LayerZero's cross-chain messaging layer by tricking it into believing a valid instruction had been received from another network, resulting in the release of 116,500 rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain. However, two subsequent attempts to drain an additional 40,000 rsETH, worth approximately $100 million, were reverted. The stolen rsETH was the reserve backing wrapped versions of the token on every layer 2 blockchain, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. This has created a feedback loop where panic redemptions on layer 2 blockchains may pressure the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The fallout from this incident has been widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets, and AAVE experiencing a 10% decline in value as the market priced potential bad debt. Lido Finance has also paused further deposits into its earnETH product due to its exposure to rsETH. The stablecoin issuer Ethena temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp DAO, a product under the KernelDAO umbrella, has acknowledged the incident and is investigating the matter with LayerZero, Unichain, its auditors, and outside security specialists. The ability of rsETH to maintain its peg over the weekend will depend on the extent to which the cross-chain float tries to redeem into ETH on Ethereum and whether Kelp can recover any portion of the stolen funds before the trail goes cold. This attack is the latest in a series of DeFi exploits, including the $285 million drain of Solana-based perpetuals protocol Drift on April 1, and has become the largest DeFi exploit of 2026.