Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

In a shocking turn of events, a cross-chain bridge holding nearly a fifth of the circulating supply of restaked ether tokens has been drained, sending shockwaves through the DeFi ecosystem. On Saturday, an attacker exploited Kelp DAO's LayerZero-powered bridge, making off with 116,500 rsETH, valued at approximately $292 million. This breach has significant implications, as the stolen tokens were backed by wrapped versions deployed across over 20 blockchains, including Base, Arbitrum, and Scroll. The attacker manipulated LayerZero's messaging layer, tricking it into releasing the rsETH to an attacker-controlled address. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The fallout is widespread, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident has also led to a temporary pause of LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. As the situation unfolds, the fate of rsETH's peg hangs in the balance, dependent on the ability of Kelp to recover the stolen funds and the actions of holders across the affected blockchains.