Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating hack has struck a cross-chain bridge, resulting in the theft of nearly a fifth of the circulating supply of restaked ether tokens, valued at around $292 million. The attack occurred on Saturday at 17:35 UTC, when an attacker exploited a vulnerability in LayerZero's cross-chain messaging layer, tricking the system into releasing 116,500 rsETH to a malicious address. The stolen funds were part of the reserve backing wrapped versions of the token on over 20 blockchains, including Base, Arbitrum, and Scroll. The incident has triggered a wave of panic, with multiple DeFi platforms, such as Aave and SparkLend, freezing their rsETH markets to prevent further losses. The attacker's actions have also raised concerns about the potential for a broader market contagion, as holders of rsETH on non-Ethereum deployments face uncertainty about the value of their tokens. Kelp DAO has acknowledged the incident and is working with LayerZero and other experts to investigate and recover the stolen funds. The hack is the largest DeFi exploit of 2026, surpassing the $285 million loss suffered by Solana-based perpetuals protocol Drift in April.