Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating exploit has struck the DeFi space, with an attacker successfully draining nearly 18% of the circulating supply of restaked ether tokens from Kelp DAO's LayerZero-powered bridge. The heist, which occurred on Saturday at 17:35 UTC, saw the attacker make off with 116,500 rsETH, worth around $292 million at current prices. The bridge in question held the rsETH reserve that backed wrapped versions of the token deployed across over 20 other blockchains, including Base, Arbitrum, and Scroll. The attacker managed to trick LayerZero's cross-chain messaging layer into releasing the funds to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC. However, two subsequent attempts to drain an additional 40,000 rsETH, valued at approximately $100 million, were thwarted. The incident has sparked a wave of panic, with holders of rsETH on non-Ethereum deployments facing uncertainty over the value of their tokens. This has created a feedback loop, where panic redemptions on layer 2 blockchains are putting pressure on the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The fallout has been swift, with Aave, SparkLend, and Fluid freezing their rsETH markets, while Lido Finance has paused further deposits into its earnETH product. The incident serves as a stark reminder of the risks and vulnerabilities present in the DeFi space, particularly in the wake of recent exploits, including the $285 million heist of Solana-based perpetuals protocol Drift on April 1.