Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

In a shocking turn of events, a cross-chain bridge holding nearly a fifth of the circulating supply of restaked ether tokens has been exploited, triggering a frantic response across the DeFi landscape. On Saturday, at 17:35 UTC, an attacker successfully drained 116,500 rsETH, valued at around $292 million, from Kelp DAO's LayerZero-powered bridge. This represents approximately 18% of the total rsETH circulating supply. LayerZero, a cross-chain messaging layer, enables different blockchains to communicate with each other, while Kelp DAO is a liquid restaking protocol that generates additional yield on top of standard Ethereum staking rewards by routing user-deposited ETH through EigenLayer and issuing rsETH as a tradeable receipt. The drained bridge held the rsETH reserve backing wrapped versions of the token on more than 20 other blockchains, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll. The attacker manipulated LayerZero's cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC, but two subsequent attempts to drain an additional 40,000 rsETH, worth roughly $100 million, were reverted. The exploited rsETH was deployed across multiple networks, with LayerZero's OFT standard handling cross-chain movement. As a result, holders on non-Ethereum deployments are now faced with uncertainty regarding the value of their tokens, creating a potential feedback loop where panic redemptions on layer 2 blockchains pressure the unaffected Ethereum supply, which may force Kelp to unwind restaking positions to honor withdrawals. The fallout has been swift, with Aave, SparkLend, and Fluid freezing their rsETH markets, while Lido Finance has paused further deposits into its earnETH product due to rsETH exposure. The incident has also led to a temporary pause of Ethena's LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp, a product under the KernelDAO umbrella, has acknowledged the incident and is investigating with LayerZero, Unichain, its auditors, and outside security specialists. The hack has significant implications for the DeFi space, which is already reeling from a series of recent exploits, including the $285 million drain of Solana-based perpetuals protocol Drift on April 1. Whether rsETH will maintain its peg over the weekend remains uncertain, depending on the extent of cross-chain redemptions and Kelp's ability to recover any portion of the stolen funds before the trail goes cold.