Crypto Exploit of 2026: $292 Million Stolen from Kelp DAO, Leaving 20 Chains with Stranded Wrapped Ether

A devastating cross-chain bridge attack has resulted in the theft of nearly a fifth of the circulating supply of restaked ether tokens, with the stolen funds now scattered across over 20 blockchain networks. The attack occurred on Saturday at 17:35 UTC, when an attacker drained 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, valued at approximately $292 million. This represents around 18% of the total 630,000 rsETH tokens in circulation, according to CoinGecko. Kelp DAO is a liquid restaking protocol that utilizes user-deposited ETH to generate additional yield on top of standard Ethereum staking rewards, issuing rsETH as a tradeable receipt. The exploited bridge held the rsETH reserve that backed wrapped versions of the token deployed on multiple blockchain networks. The attacker successfully tricked LayerZero's cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the attack, at 18:21 UTC. Two subsequent attempts to drain an additional 40,000 rsETH, worth around $100 million, were made at 18:26 UTC and 18:28 UTC but were reverted. The stolen rsETH was held in a bridge that served as the reserve backing wrapped versions of the token on over 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll. With the reserve depleted, holders of wrapped tokens on non-Ethereum deployments are now faced with the uncertainty of whether their tokens are backed by any underlying assets, creating a potential feedback loop where panic redemptions on layer 2 blockchains may pressure the unaffected Ethereum supply. This could force Kelp to unwind its restaking positions to honor withdrawals. The fallout from the exploit is widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets. Aave's founder, Stani Kulechov, confirmed that the exploit was external and did not compromise Aave's contracts. The AAVE token price dropped by around 10% as the market reacted to the potential bad debt. Lido Finance paused further deposits into its earnETH product, which has exposure to rsETH, while clarifying that stETH and wstETH are unaffected and the core Lido staking protocol is not involved in the incident. Ethena temporarily paused its LayerZero OFT bridges from the Ethereum mainnet as a precautionary measure, stating that it has no rsETH exposure and remains over 101% overcollateralized. Kelp, a product under the KernelDAO umbrella, publicly acknowledged the incident nearly three hours after the attack and is currently investigating the exploit with LayerZero, Unichain, its auditors, and outside security specialists. The protocol has not disclosed how the exploit bypassed the bridge's validation logic. The outcome of the exploit depends on how much of the cross-chain float attempts to redeem into ETH on Ethereum and whether Kelp can recover any portion of the stolen funds before the trail goes cold. This attack comes during a particularly challenging period for DeFi, with Solana-based perpetuals protocol Drift being drained of around $285 million on April 1, and at least a dozen smaller protocols being exploited in recent weeks, including CoW Swap, Zerion, Rhea Finance, and Silo Finance. The $292 million loss suffered by Kelp DAO is now the largest DeFi exploit of 2026, surpassing the Drift exploit by a few million dollars.