Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating hack has struck a cross-chain bridge, resulting in the theft of nearly a fifth of a restaked ether token's circulating supply. On Saturday, an attacker successfully drained 116,500 rsETH, valued at around $292 million, from Kelp DAO's LayerZero-powered bridge, which represents approximately 18% of the token's total supply. The breach occurred at 17:35 UTC, with the attacker exploiting LayerZero's cross-chain messaging layer to trick the bridge into releasing the rsETH to a malicious address. The stolen funds were part of the reserve backing wrapped versions of the token deployed across over 20 blockchains, including Base, Arbitrum, and Scroll. The incident has triggered a wave of panic, with holders of rsETH on non-Ethereum deployments facing uncertainty about the value of their tokens. In response, several DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets, while Lido Finance has paused further deposits into its earnETH product. The fallout from the hack is expected to be far-reaching, with potential contagion risks and a significant impact on the DeFi market. Kelp DAO has acknowledged the incident and is investigating the matter with LayerZero, Unichain, and outside security specialists. The hack is the largest DeFi exploit of 2026, surpassing the recent $285 million heist on Solana-based perpetuals protocol Drift.