Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Chains with Stranded Wrapped Ether

A devastating crypto exploit has occurred, with an attacker successfully draining 116,500 rsETH, equivalent to roughly $292 million, from Kelp DAO's LayerZero-powered bridge. This significant loss accounts for approximately 18% of the circulating supply of rsETH, a restaked ether token. The breach happened at 17:35 UTC on Saturday, with the attacker manipulating LayerZero's cross-chain messaging layer to release the funds to a controlled address. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC, to prevent further damage. However, two subsequent attempts to drain an additional 40,000 rsETH were made, both of which were reverted. The exploited bridge held the rsETH reserve that backed wrapped versions of the token on over 20 other blockchains, including Base, Arbitrum, and Scroll. As a result, holders of rsETH on non-Ethereum deployments are now facing uncertainty about the value of their tokens, which could lead to a feedback loop of panic redemptions and potential pressure on Kelp to unwind its restaking positions. The fallout from this exploit is widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident has also led to a temporary pause of Ethena's LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp DAO has acknowledged the incident and is investigating the matter with LayerZero, Unichain, and outside security specialists. The recovery of the stolen funds and the maintenance of rsETH's peg will be crucial in determining the extent of the damage. This major exploit comes at a time when DeFi is already under significant pressure, with several smaller protocols having been exploited in recent weeks, including CoW Swap, Zerion, Rhea Finance, and Silo Finance. The Kelp DAO hack is now the largest DeFi exploit of 2026, surpassing the $285 million loss suffered by Solana-based perpetuals protocol Drift in April.