Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains in Limbo

A devastating cyber attack has struck Kelp DAO, a liquid restaking protocol, resulting in the theft of nearly 18% of the circulating supply of rsETH, a restaked ether token. The breach, which occurred on Saturday at 17:35 UTC, saw 116,500 rsETH siphoned off from Kelp's LayerZero-powered bridge, valued at around $292 million. This incident has triggered a ripple effect, with several DeFi platforms, including Aave, SparkLend, and Fluid, taking swift action to freeze their rsETH markets. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the stolen funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts, thwarting two subsequent attempts to drain an additional 40,000 rsETH. The stolen funds were part of a reserve backing wrapped versions of rsETH on over 20 blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. As a result, a wave of panic redemptions is expected to put pressure on the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The fallout from this incident is still unfolding, with several platforms, including Lido Finance and Ethena, taking precautionary measures to mitigate potential losses. The incident has also sparked concerns about the security of DeFi protocols, particularly in light of recent attacks on other platforms, such as Solana-based perpetuals protocol Drift, which was drained of approximately $285 million in April.