Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A significant security breach has occurred in the DeFi space, with a cross-chain bridge being drained of nearly 18% of the circulating supply of restaked ether tokens. On Saturday, an attacker successfully exploited Kelp DAO's LayerZero-powered bridge, making off with 116,500 rsETH tokens, valued at approximately $292 million. This incident has triggered a series of emergency measures across various DeFi platforms, including Aave, SparkLend, and Fluid, which have frozen their rsETH markets to prevent further losses. The attacker managed to trick LayerZero's cross-chain messaging layer into releasing the tokens to an attacker-controlled address. Kelp DAO's emergency response team froze the protocol's core contracts 46 minutes after the attack, but not before the attacker attempted to drain an additional 40,000 rsETH tokens. The stolen tokens were part of a reserve backing wrapped versions of rsETH deployed on over 20 other blockchains, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. This has created a ripple effect, with panic redemptions on layer 2 blockchains putting pressure on the unaffected Ethereum supply. As a result, Kelp may be forced to unwind its restaking positions to honor withdrawals. The incident has already had a significant impact on the market, with AAVE falling by around 10% due to concerns about potential bad debt. Lido Finance has also paused further deposits into its earnETH product, which carries rsETH exposure, while Ethena has temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precaution. The fallout from this incident is still unfolding, with Kelp acknowledging the attack and investigating the matter with LayerZero, Unichain, and outside security specialists. The ability of rsETH to maintain its peg over the weekend will depend on how much of the cross-chain float tries to redeem into ETH on Ethereum and whether Kelp can recover any portion of the stolen funds before the trail goes cold. This incident is the latest in a series of DeFi exploits, including the $285 million drain of Solana-based perpetuals protocol Drift on April 1, and highlights the ongoing security risks in the DeFi space.