Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A catastrophic breach occurred on Saturday at 17:35 UTC, when an attacker successfully drained 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, equivalent to roughly 18% of the token's circulating supply. The stolen funds, worth around $292 million, have raised concerns about the stability of the DeFi ecosystem. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield on top of standard Ethereum staking rewards, issuing rsETH as a tradeable receipt. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the attack. The incident has triggered a wave of panic, with Aave, SparkLend, and Fluid freezing their rsETH markets, while Lido Finance has paused further deposits into its earnETH product. The fallout is being felt across over 20 networks, including Base, Arbitrum, and Scroll, where rsETH is deployed, with the potential for a feedback loop of panic redemptions and pressure on the unaffected Ethereum supply. As the situation unfolds, the DeFi community remains on high alert, with many protocols taking precautionary measures to mitigate potential losses. The hack is the largest DeFi exploit of 2026, surpassing the $285 million drained from Solana-based perpetuals protocol Drift on April 1.