Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A recent and severe security breach has resulted in the theft of nearly a fifth of the circulating supply of a restaked ether token, triggering a wave of emergency measures across the DeFi landscape. On Saturday, at 17:35 UTC, an attacker exploited Kelp DAO's LayerZero-powered bridge, siphoning off 116,500 rsETH, valued at approximately $292 million, and accounting for roughly 18% of the token's total circulating supply. This cross-chain bridge, which utilizes LayerZero's messaging layer to facilitate communication between different blockchains, had been holding the rsETH reserve that backed wrapped versions of the token on over 20 other blockchains. The attacker successfully deceived LayerZero's cross-chain messaging layer into releasing the funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the breach. However, two subsequent attempts to drain an additional 40,000 rsETH, worth around $100 million, were thwarted. The stolen rsETH was the reserve backing wrapped versions of the token on numerous layer 2 blockchains, which now face uncertainty regarding the value of their holdings. This has created a ripple effect, with panic redemptions on layer 2 blockchains potentially pressuring the Ethereum supply and forcing Kelp to unwind its restaking positions to honor withdrawals. The fallout from this incident has been widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The stablecoin issuer Ethena has also temporarily paused its LayerZero OFT bridges as a precautionary measure. Kelp, which operates under the KernelDAO umbrella, has acknowledged the incident and is currently investigating the breach with the assistance of LayerZero, Unichain, its auditors, and external security specialists. The protocol has not yet disclosed how the exploit managed to bypass the bridge's validation logic. The success of rsETH in maintaining its peg over the weekend hinges on the extent to which the cross-chain float attempts to redeem into ETH on Ethereum and Kelp's ability to recover any portion of the stolen funds before the trail goes cold. This heist is the latest in a series of attacks targeting DeFi protocols, including the recent $285 million drain of Solana-based perpetuals protocol Drift, and has cemented its position as the largest DeFi exploit of 2026.