2026's Largest Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A catastrophic breach of a cross-chain bridge has led to the theft of nearly one-fifth of a restaked ether token's circulating supply, sending shockwaves through the DeFi ecosystem faster than Kelp DAO can respond. On Saturday, at 17:35 UTC, an attacker exploited Kelp DAO's LayerZero-powered bridge, siphoning off 116,500 rsETH, valued at approximately $292 million, which accounts for roughly 18% of the token's 630,000-unit circulating supply. LayerZero, a cross-chain messaging layer, facilitates communication between different blockchains, while Kelp DAO operates as a liquid restaking protocol, leveraging user-deposited ETH to generate additional yield beyond standard Ethereum staking rewards, issuing rsETH as a tradable receipt. The compromised bridge held the rsETH reserve backing wrapped versions of the token deployed across over 20 blockchains. The attacker deceived LayerZero's cross-chain messaging layer into executing a fake instruction from another network, triggering the release of 116,500 rsETH to an attacker-controlled address. Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC, following two unsuccessful attempts to drain an additional 40,000 rsETH, worth around $100 million. The rsETH token is deployed across multiple networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard handling cross-chain transactions. As the reserve backing wrapped versions on layer 2 blockchains has been depleted, holders on non-Ethereum deployments face uncertainty regarding the value of their tokens, creating a feedback loop where panic redemptions on layer 2 blockchains pressure the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The list of affected platforms continues to grow, with Aave, SparkLend, and Fluid freezing rsETH markets, and AAVE experiencing a 10% price drop. Lido Finance has paused further deposits into its earnETH product, citing rsETH exposure, while Ethena has temporarily paused its LayerZero OFT bridges as a precaution. Kelp, a product under the KernelDAO umbrella, acknowledged the incident and is investigating the exploit with LayerZero, Unichain, auditors, and security specialists. The future of rsETH's peg depends on the redemption of cross-chain tokens into ETH on Ethereum and Kelp's ability to recover the stolen funds before the trail goes cold. This attack occurs during a particularly challenging period for DeFi, following a string of exploits, including the $285 million heist of Solana-based perpetuals protocol Drift, and marks the largest DeFi exploit of 2026.