2026's Largest Crypto Heist: Kelp DAO Loses $292 Million in rsETH Theft

A devastating crypto heist has struck Kelp DAO, a liquid restaking protocol, with an attacker making off with nearly $292 million worth of rsETH, a restaked ether token. The breach occurred on Saturday at 17:35 UTC, when the attacker exploited a vulnerability in LayerZero's cross-chain messaging layer to trick the bridge into releasing 116,500 rsETH to a malicious address. The stolen funds represent approximately 18% of the total circulating supply of rsETH, which is currently tracked by CoinGecko. Kelp DAO's emergency response team froze the protocol's core contracts 46 minutes after the attack, but not before the attacker attempted two follow-up transactions. The incident has sent shockwaves throughout the DeFi ecosystem, with several major platforms, including Aave, SparkLend, and Fluid, freezing their rsETH markets in response. The attack has also raised concerns about the potential for a liquidity crisis, as holders of rsETH on non-Ethereum deployments face uncertainty about the value of their tokens. With the contagion list continuing to grow, the incident is likely to have far-reaching consequences for the DeFi space.