2026's Largest Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating exploit has struck the DeFi world, with an attacker successfully draining nearly 18% of the circulating supply of restaked ether (rsETH) from Kelp DAO's LayerZero-powered bridge. The stolen funds, worth around $292 million, have left a trail of uncertainty across more than 20 blockchains where wrapped versions of the token are deployed. At 17:35 UTC on Saturday, the attacker manipulated LayerZero's cross-chain messaging layer, tricking it into releasing 116,500 rsETH to a malicious address. This reserve was the backbone of wrapped rsETH tokens on various layer 2 blockchains, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll. Kelp DAO's emergency response team sprang into action, freezing the protocol's core contracts 46 minutes after the attack. However, two subsequent attempts to drain an additional 40,000 rsETH, valued at approximately $100 million, were thwarted. The aftermath of the exploit has sent shockwaves throughout the DeFi ecosystem, with Aave, SparkLend, and Fluid promptly freezing their rsETH markets. The AAVE token plummeted by around 10% as the market digested the potential implications of the exploit. Lido Finance has paused deposits into its earnETH product, which has exposure to rsETH, while emphasizing that its stETH and wstETH products remain unaffected. Ethena, a stablecoin issuer, has temporarily halted its LayerZero OFT bridges as a precautionary measure. Kelp DAO, a product under the KernelDAO umbrella, has acknowledged the incident and is working with LayerZero, Unichain, auditors, and security specialists to investigate the matter. The protocol has not disclosed the specifics of how the exploit bypassed the bridge's validation logic. As the DeFi community grapples with the fallout, the coming days will be crucial in determining whether rsETH can maintain its peg. The ability of Kelp DAO to recover any portion of the stolen funds and the extent of the cross-chain redemption pressure will be key factors in shaping the outcome. This latest attack comes amid a challenging period for DeFi, with several protocols, including Drift, CoW Swap, Zerion, Rhea Finance, and Silo Finance, having been exploited in recent weeks. The Kelp DAO hack now stands as the largest DeFi exploit of 2026, surpassing the $285 million stolen from Solana-based perpetuals protocol Drift in April.