Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A significant breach occurred in the DeFi space when an attacker exploited a vulnerability in Kelp DAO's LayerZero-powered bridge, draining nearly 18% of the circulating supply of restaked ether tokens. The incident has sent shockwaves throughout the cryptocurrency market, with the stolen funds valued at around $292 million. The attacker manipulated LayerZero's cross-chain messaging layer, tricking it into releasing 116,500 rsETH to an attacker-controlled address. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The breach has raised concerns among holders of wrapped versions of the token on over 20 networks, including Base, Arbitrum, and Scroll, as the reserve backing these tokens has been depleted. As a result, a panic redemption cycle may ensue, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The incident has already led to a freeze on rsETH markets on Aave, SparkLend, and Fluid, with AAVE's price dropping by around 10%. Other platforms, such as Lido Finance and Ethena, have also taken precautionary measures to mitigate potential losses. The exploit has highlighted the vulnerabilities in DeFi's cross-chain infrastructure and the need for enhanced security measures to protect against such attacks. With the cryptocurrency market already under pressure, the Kelp DAO breach has added to the uncertainty, making it challenging for the market to recover in the short term.