Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A devastating cyber attack has hit Kelp DAO, a liquid restaking protocol, with the perpetrator making off with a staggering 116,500 rsETH, valued at approximately $292 million. This significant breach has sent shockwaves throughout the DeFi ecosystem, affecting over 20 blockchains where the wrapped version of the token is deployed. The attacker exploited LayerZero's cross-chain messaging layer, tricking it into releasing the funds to a controlled address. In response, Kelp DAO's emergency pauser multisig froze the core contracts, but not before the attacker attempted two further transactions. The stolen rsETH was the reserve backing the wrapped tokens on various layer 2 blockchains, leaving holders uncertain about the value of their assets. As a result, several DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets, while others, like Lido Finance, have paused deposits into related products. The incident has also led to a decline in AAVE's value and raised concerns about potential bad debt. With the contagion spreading, the DeFi community is on high alert, and the situation remains fluid as Kelp DAO and its partners investigate the incident and work to mitigate the damage.