Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating cyber attack has drained nearly 18% of the circulating supply of restaked ether from Kelp DAO's LayerZero-powered bridge, sparking a wave of panic across the DeFi landscape. The exploit, which occurred on Saturday at 17:35 UTC, saw 116,500 rsETH siphoned off, worth around $292 million at current prices. This significant breach has left the crypto community reeling, with the attacker managing to trick LayerZero's cross-chain messaging layer into releasing the funds to an attacker-controlled address. The fallout is being felt across over 20 blockchains, including Base, Arbitrum, and Scroll, where wrapped versions of the token are deployed. With the reserve backing these wrapped tokens now depleted, holders are faced with uncertainty regarding the value of their assets, leading to a potential feedback loop of panic redemptions. In response, several major DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets, while Lido Finance has paused further deposits into its earnETH product. The incident has also led to a significant decline in the value of AAVE, with the token falling by around 10% as the market reacts to the potential bad debt. As the situation continues to unfold, all eyes are on Kelp DAO and its efforts to recover the stolen funds and restore confidence in the protocol. The attack is the latest in a string of high-profile exploits to hit the DeFi space, with Solana-based perpetuals protocol Drift being drained of $285 million just last month. The Kelp DAO hack now stands as the largest DeFi exploit of 2026, surpassing the Drift incident by a few million dollars.