Kelp DAO Hit by Massive $292 Million Crypto Heist, 18% of rsETH Supply Drained

A devastating crypto heist has struck Kelp DAO, with an attacker making off with approximately $292 million worth of rsETH, roughly 18% of the token's circulating supply. The breach occurred on Saturday at 17:35 UTC, when the attacker tricked LayerZero's cross-chain messaging layer into releasing 116,500 rsETH from Kelp's bridge to an attacker-controlled address. LayerZero is a crucial infrastructure that enables different blockchains to send verified instructions to one another. Kelp DAO is a liquid restaking protocol that utilizes user-deposited ETH to generate additional yield on top of standard Ethereum staking rewards, issuing rsETH as a tradeable receipt. The drained bridge held the rsETH reserve that backed wrapped versions of the token on over 20 other blockchains. Following the attack, Kelp's emergency pauser multisig froze the protocol's core contracts, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The aftermath of the exploit has sent shockwaves through the DeFi ecosystem, with Aave, SparkLend, and Fluid freezing their rsETH markets and Lido Finance pausing further deposits into its earnETH product. The incident has raised concerns about the potential for a feedback loop of panic redemptions on layer 2 blockchains, which could pressure the unaffected Ethereum supply and force Kelp to unwind restaking positions to honor withdrawals. As the situation continues to unfold, the DeFi community is left to ponder the implications of this massive exploit and the potential consequences for the broader cryptocurrency market.