Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A recent security breach has left the DeFi community reeling, as an attacker successfully drained nearly a fifth of the circulating supply of restaked ether tokens from Kelp DAO's LayerZero-powered bridge, sparking a chain reaction of emergency freezes and market volatility. The attack, which occurred on Saturday at 17:35 UTC, saw the theft of 116,500 rsETH, worth roughly $292 million at current prices, and representing approximately 18% of the token's circulating supply. The bridge in question held the rsETH reserve backing wrapped versions of the token deployed across more than 20 blockchains, including Base, Arbitrum, and Scroll. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the funds to an attacker-controlled address. Kelp DAO's emergency response team froze the protocol's core contracts 46 minutes after the attack, but not before the attacker attempted two further drain attempts, each worth approximately $100 million. The fallout from the attack is being felt across the DeFi ecosystem, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident has also led to a decline in the value of AAVE, with the token falling by around 10% as the market prices in potential bad debt. As the situation continues to unfold, holders of rsETH on non-Ethereum deployments are facing uncertainty over the value of their tokens, and the potential for a feedback loop of panic redemptions and forced unwinding of restaking positions. The attack is the latest in a series of high-profile exploits to hit the DeFi space in recent weeks, including the $285 million hack of Solana-based perpetuals protocol Drift, and highlights the ongoing security risks faced by the industry.