2026's Largest Crypto Heist: Kelp DAO Loses $292 Million in rsETH Due to LayerZero Bridge Exploit

A devastating hack has struck Kelp DAO, a liquid restaking protocol, with an attacker making off with 116,500 rsETH, valued at roughly $292 million, by exploiting a vulnerability in the protocol's LayerZero-powered bridge. The breach occurred on Saturday at 17:35 UTC, with the attacker tricking the cross-chain messaging layer into releasing the funds to a controlled address. The stolen rsETH represents approximately 18% of the token's circulating supply. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC, to prevent further losses. However, two subsequent attempts by the attacker to drain an additional 40,000 rsETH were thwarted. The incident has sent shockwaves throughout the DeFi ecosystem, with multiple platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets as a precautionary measure. The attack has also raised concerns about the potential for a liquidity crisis, as the drained rsETH reserve was backing wrapped versions of the token on over 20 other blockchains. As the situation continues to unfold, the DeFi community is left to grapple with the implications of this massive exploit, which has become the largest of 2026, surpassing the recent Solana-based Drift protocol hack.