Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A recent attack has drained a substantial amount of restaked ether tokens from Kelp DAO's cross-chain bridge, sparking a chain reaction of emergency measures across the DeFi landscape. On Saturday, at 17:35 UTC, an attacker successfully siphoned off 116,500 rsETH, valued at around $292 million, from Kelp's LayerZero-powered bridge. This staggering sum accounts for roughly 18% of the token's circulating supply. LayerZero, a cross-chain messaging layer, enables different blockchains to communicate with each other, while Kelp DAO operates as a liquid restaking protocol, leveraging user-deposited ETH to generate additional yield on top of standard Ethereum staking rewards. The exploited bridge held the rsETH reserve backing wrapped versions of the token on over 20 other blockchains. The attacker manipulated LayerZero's cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC. Two subsequent attempts to drain an additional 40,000 rsETH, worth approximately $100 million, were successfully reverted. The rsETH tokens are deployed across more than 20 networks, including Base, Arbitrum, and Scroll, with LayerZero's OFT standard facilitating cross-chain movement. With the reserve depleted, holders on non-Ethereum deployments face uncertainty regarding the value of their tokens, potentially triggering a feedback loop of panic redemptions on L2s, which could pressure the unaffected Ethereum supply and force Kelp to unwind restaking positions to honor withdrawals. The fallout is being felt across the DeFi ecosystem, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident has sparked concerns about potential bad debt, with AAVE's price plummeting by around 10%. As the situation continues to unfold, the DeFi community remains on high alert, with many protocols taking precautionary measures to mitigate potential risks.