Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchain Networks Exposed

A catastrophic breach has occurred in the DeFi space, with an attacker successfully draining nearly a fifth of the circulating supply of restaked ether tokens from Kelp DAO's LayerZero-powered bridge, triggering widespread panic and emergency freezes across various platforms. On Saturday at 17:35 UTC, an attacker exploited a vulnerability in the bridge, making off with 116,500 rsETH, valued at approximately $292 million at current prices. This represents about 18% of the total 630,000 rsETH tokens in circulation, as tracked by CoinGecko. Kelp DAO, a liquid restaking protocol, utilizes user-deposited ETH to generate additional yield on top of standard Ethereum staking rewards through EigenLayer, issuing rsETH as a tradeable receipt. The breached bridge held the rsETH reserve backing wrapped versions of the token deployed across more than 20 blockchain networks. The attacker manipulated LayerZero's cross-chain messaging layer, deceiving it into believing a legitimate instruction had been received from another network. This triggered the release of 116,500 rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts at 18:21 UTC, 46 minutes after the successful heist. Two subsequent attempts at 18:26 UTC and 18:28 UTC were thwarted, each attempting to drain an additional 40,000 rsETH, valued at roughly $100 million. The rsETH tokens are deployed across over 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard facilitating cross-chain movement. The drained rsETH reserve was the backing for wrapped versions on every layer 2 blockchain, raising concerns among holders on non-Ethereum deployments about the validity of their tokens. This has created a feedback loop where panic redemptions on layer 2 blockchains may pressure the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The list of affected platforms continues to grow, with Aave, SparkLend, and Fluid freezing their rsETH markets in response to the exploit. Aave's founder, Stani Kulechov, confirmed that the exploit was external and did not compromise Aave's contracts. The AAVE token experienced a decline of approximately 10% as the market accounted for potential bad debt. Lido Finance paused further deposits into its earnETH product, which has exposure to rsETH, while emphasizing that stETH and wstETH are unaffected and the core Lido staking protocol is not involved in the incident. Ethena temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure, stating that it has no rsETH exposure and remains over 101% overcollateralized. The stablecoin issuer expects the pause to last approximately six hours while the root cause is identified. Kelp, a product under the KernelDAO umbrella, publicly acknowledged the incident nearly three hours after the breach, stating that it is investigating the matter with LayerZero, Unichain, its auditors, and outside security specialists. However, the protocol has not disclosed how the exploit bypassed the bridge's validation logic. The stability of rsETH over the weekend depends on the extent to which the cross-chain float attempts to redeem into ETH on Ethereum and whether Kelp can recover any portion of the stolen funds before the Tornado Cash trail goes cold. This attack occurs during an unusually turbulent period for DeFi, following the $285 million drain of Solana-based perpetuals protocol Drift on April 1, which was later linked to North Korea-affiliated actors. At least a dozen smaller protocols have been exploited in recent weeks, including CoW Swap, Zerion, Rhea Finance, and Silo Finance. Kelp's $292 million loss now represents the largest DeFi exploit of 2026, surpassing Drift by a few million dollars.