Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A significant breach has occurred in the DeFi sector, with an attacker successfully draining 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply, from Kelp DAO's LayerZero-powered bridge. The incident, which took place on Saturday, has triggered a series of emergency freezes across various platforms, including Aave, SparkLend, Fluid, and Upshift. The stolen funds, valued at approximately $292 million, were held in a cross-chain bridge that supported wrapped versions of the token across more than 20 blockchains. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts, preventing further unauthorized transactions. However, the incident has raised concerns about the potential for a liquidity crisis, as holders of rsETH on non-Ethereum deployments may face uncertainty about the value of their tokens. The fallout from the exploit is still unfolding, with several DeFi platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets. Additionally, Lido Finance has paused further deposits into its earnETH product, citing exposure to rsETH. The incident highlights the ongoing risks and challenges faced by the DeFi sector, particularly in relation to cross-chain bridges and the potential for exploits. As the situation continues to evolve, it remains to be seen how the affected platforms and the broader DeFi community will respond to this major security breach.