Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating breach occurred on Saturday when an attacker successfully drained 116,500 rsETH, equivalent to around 18% of the circulating supply, from Kelp DAO's LayerZero-powered bridge, valued at roughly $292 million. This incident has sent shockwaves throughout the DeFi space, with the attacker exploiting a vulnerability in LayerZero's cross-chain messaging layer to trick the bridge into releasing the funds to an attacker-controlled address. The Kelp DAO protocol, which operates as a liquid restaking protocol, has paused its core contracts in response to the attack. However, the impact of the breach is far-reaching, with the stolen rsETH reserve backing wrapped versions of the token on over 20 blockchains, including Base, Arbitrum, and Scroll. As a result, holders of these tokens are now facing uncertainty regarding the value of their assets, leading to a potential feedback loop of panic redemptions that could put pressure on the unaffected Ethereum supply. The fallout from the incident has already led to Aave, SparkLend, and Fluid freezing their rsETH markets, while Lido Finance has paused further deposits into its earnETH product due to its exposure to rsETH. The incident serves as a stark reminder of the risks and vulnerabilities present in the DeFi space, particularly in the context of cross-chain bridges and liquid staking protocols.