Crypto's Latest Blow: $292 Million Stolen from Kelp DAO in Major Exploit

In a devastating blow to the cryptocurrency world, an attacker has successfully drained approximately $292 million from Kelp DAO, a liquid restaking protocol that utilizes LayerZero's cross-chain messaging layer. The attack, which occurred on Saturday, saw the thief make off with 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply. This breach has far-reaching implications, as the stolen rsETH was being used as a reserve to back wrapped versions of the token on over 20 different blockchains, including Base, Arbitrum, and Scroll. The fallout from this incident is being felt across the DeFi ecosystem, with multiple platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets in response to the attack. The situation is further complicated by the fact that rsETH is deployed across numerous networks, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. As the market struggles to come to terms with this latest exploit, the price of AAVE has fallen by approximately 10%, reflecting concerns about potential bad debt. In response to the incident, Lido Finance has paused further deposits into its earnETH product, which has exposure to rsETH, while Ethena has temporarily halted its LayerZero OFT bridges as a precautionary measure. Kelp DAO, which is a product under the KernelDAO umbrella, has acknowledged the incident and is working with LayerZero, Unichain, and outside security specialists to investigate the attack. The incident serves as a stark reminder of the risks associated with the DeFi space and the importance of robust security measures to prevent such exploits. With the hack being the largest DeFi exploit of 2026, it remains to be seen how the situation will unfold and whether Kelp DAO will be able to recover any of the stolen funds.