Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

A significant breach has occurred in the DeFi space, with an attacker successfully draining a substantial amount of restaked ether (rsETH) from Kelp DAO's LayerZero-powered bridge. The incident, which took place on Saturday at 17:35 UTC, saw the theft of 116,500 rsETH, representing around 18% of the token's circulating supply. This has triggered a series of emergency responses across the DeFi ecosystem, including the freezing of contracts on Aave, SparkLend, and Fluid. The attack exploited a vulnerability in LayerZero's cross-chain messaging layer, allowing the attacker to trick the system into releasing the rsETH to an attacker-controlled address. The fallout from this incident is still unfolding, with the potential for further contagion and market instability. The Kelp DAO protocol, which is part of the KernelDAO umbrella, has acknowledged the incident and is working with LayerZero, Unichain, auditors, and security specialists to investigate and recover the stolen funds. The incident highlights the ongoing risks and challenges in the DeFi space, particularly with regards to cross-chain bridges and the potential for exploits. As the situation continues to develop, it remains to be seen how the markets will respond and what measures will be taken to prevent similar incidents in the future.