2026's Most Significant Crypto Heist: Kelp DAO Loses $292 Million in rsETH to Hackers Across 20 Blockchain Networks

A devastating hack has struck the DeFi world, with a staggering $292 million worth of rsETH being drained from Kelp DAO's LayerZero-powered bridge. This breach, which occurred on Saturday at 17:35 UTC, accounts for roughly 18% of the token's circulating supply. The attacker exploited a vulnerability in LayerZero's cross-chain messaging layer, deceiving it into releasing 116,500 rsETH to an attacker-controlled address. The fallout has been swift, with Kelp DAO's emergency pauser multisig freezing the protocol's core contracts 46 minutes after the successful drain. However, two subsequent attempts to drain an additional 40,000 rsETH were thwarted. The impact of this exploit is far-reaching, with rsETH being deployed across over 20 networks, including Base, Arbitrum, and Scroll. As a result, holders on non-Ethereum deployments are now faced with uncertainty regarding the value of their tokens, potentially triggering a feedback loop of panic redemptions. Major DeFi players such as Aave, SparkLend, and Fluid have responded by freezing rsETH markets, while Lido Finance has paused further deposits into its earnETH product. The incident has also led to a temporary pause of LayerZero OFT bridges from Ethereum mainnet by Ethena as a precautionary measure. As the DeFi community grapples with the aftermath of this significant exploit, the coming days will be crucial in determining the fate of rsETH and the broader DeFi ecosystem.