Massive Crypto Heist: $292 Million Lost from Kelp DAO as 18% of Circulating rsETH is Drained Across 20 Blockchains

A catastrophic breach occurred on a cross-chain bridge holding nearly one-fifth of the circulating supply of a restaked ether token, triggering a series of emergency measures across the DeFi ecosystem. On Saturday, at 17:35 UTC, an attacker exploited Kelp DAO's LayerZero-powered bridge, siphoning off 116,500 rsETH, equivalent to roughly $292 million at current prices and representing about 18% of the token's 630,000 circulating supply. The exploited bridge was responsible for holding the rsETH reserve backing wrapped versions of the token deployed on over 20 other blockchains. The attacker manipulated LayerZero's cross-chain messaging layer into releasing the funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the attack. Two subsequent attempts to drain an additional 40,000 rsETH, valued at around $100 million, were thwarted. The aftermath of the attack has left holders of rsETH on non-Ethereum deployments uncertain about the value of their tokens, potentially triggering a cascade of panic redemptions. Major DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets, while Lido Finance has paused further deposits into its earnETH product. The incident has also led to a temporary pause of LayerZero OFT bridges by Ethena as a precautionary measure. Kelp DAO, a product under the KernelDAO umbrella, has acknowledged the incident and is investigating the matter with LayerZero, Unichain, and external security specialists. The hack has significant implications for the DeFi ecosystem, particularly in light of recent exploits, including the $285 million drain from Solana-based perpetuals protocol Drift on April 1. The ability of rsETH to maintain its peg over the weekend will depend on the extent of cross-chain redemptions and Kelp's capacity to recover the stolen funds.