Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A catastrophic breach of a cross-chain bridge has led to the loss of nearly a fifth of the circulating supply of a restaked ether token, with the aftermath spreading rapidly through the DeFi ecosystem. On Saturday, at 17:35 UTC, an attacker successfully drained 116,500 rsETH, valued at around $292 million, from Kelp DAO's bridge, which is powered by LayerZero, a cross-chain messaging layer. This infrastructure enables different blockchains to communicate and send verified instructions to each other. Kelp DAO, a liquid restaking protocol, utilizes user-deposited ETH to generate additional yield beyond standard Ethereum staking rewards, issuing rsETH as a tradeable receipt. The compromised bridge held the rsETH reserve that backed wrapped versions of the token deployed across more than 20 other blockchains. The attacker exploited LayerZero's cross-chain messaging layer by tricking it into believing a valid instruction had been received from another network, resulting in the release of 116,500 rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain. Subsequent attempts to drain an additional 40,000 rsETH, worth approximately $100 million, were reverted. The rsETH token is deployed across numerous networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard facilitating cross-chain movement. The drained rsETH reserve backed wrapped versions of the token on every layer 2 blockchain, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. This uncertainty has created a feedback loop where panic redemptions on layer 2 blockchains may pressure the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The list of affected platforms continues to grow, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The stablecoin issuer Ethena temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp acknowledged the incident and is investigating the exploit with LayerZero, Unichain, its auditors, and outside security specialists. The fate of rsETH's peg depends on the extent of cross-chain redemptions into ETH on Ethereum and Kelp's ability to recover the stolen funds before the trail goes cold. This significant hack occurs during a particularly challenging period for DeFi, following a series of exploits, including the Solana-based perpetuals protocol Drift, which lost approximately $285 million on April 1.