Major Crypto Heist: $292 Million Stolen from Kelp DAO, Disrupting 20 Blockchain Networks

A significant cyber attack occurred on Saturday, with an attacker exploiting Kelp DAO's LayerZero-powered bridge to drain approximately 116,500 rsETH, valued at around $292 million. This represents about 18% of the token's total circulating supply. The attack has triggered a series of emergency measures, including contract freezes, across various DeFi platforms. The stolen funds were held in a cross-chain bridge that supported wrapped versions of rsETH on over 20 different blockchain networks. The attacker manipulated LayerZero's cross-chain messaging layer, tricking it into releasing the funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts, and several follow-up attempts to drain additional funds were thwarted. The incident has raised concerns about the potential for a liquidity crisis, as holders of rsETH on non-Ethereum deployments may face uncertainty about the value of their tokens. This has led to a wave of panic redemptions, which could potentially force Kelp to unwind its restaking positions to honor withdrawals. The fallout from the attack is still unfolding, with several major DeFi platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets. Lido Finance has also paused further deposits into its earnETH product, citing exposure to rsETH. The incident is the latest in a series of high-profile crypto heists, including the recent attack on Solana-based perpetuals protocol Drift, which resulted in the theft of approximately $285 million.