Crypto's Biggest Heist of 2026: Kelp DAO Loses $292 Million to Hacker

A devastating hack has left Kelp DAO reeling after an attacker made off with 116,500 rsETH, valued at approximately $292 million. The breach occurred on Saturday at 17:35 UTC, when the attacker exploited a vulnerability in LayerZero's cross-chain messaging layer to trick Kelp's bridge into releasing the funds to a malicious address. The stolen rsETH represented around 18% of the token's circulating supply. As a result, Kelp DAO's emergency pauser multisig was forced to freeze the protocol's core contracts, while other DeFi platforms such as Aave, SparkLend, and Fluid also froze their rsETH markets to mitigate potential damage. The attack has raised concerns about the stability of wrapped versions of rsETH deployed on over 20 other blockchains, with holders facing uncertainty over the value of their tokens. The incident has sparked a wave of panic redemptions, putting pressure on the unaffected Ethereum supply and potentially forcing Kelp to unwind restaking positions to honor withdrawals. The fallout is being felt across the DeFi landscape, with several major platforms taking precautionary measures to protect themselves from the contagion. With the attacker's trail potentially going cold, the coming days will be crucial in determining the fate of rsETH and the broader DeFi ecosystem.