Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A significant attack on a cross-chain bridge has led to the loss of nearly 18% of the circulating supply of a restaked ether token, sparking a wave of emergency responses across the DeFi landscape. On Saturday, at 17:35 UTC, an attacker exploited Kelp DAO's LayerZero-powered bridge, draining 116,500 rsETH, valued at around $292 million. This incident has raised concerns about the stability of the token's peg and the potential for further losses. The attacker manipulated LayerZero's cross-chain messaging system, tricking it into releasing the funds to an attacker-controlled address. In response, Kelp DAO's emergency pauser multisig froze the core contracts 46 minutes later, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The stolen funds were part of the reserve backing wrapped versions of the token on over 20 networks, including Base, Arbitrum, and Scroll. As a result, holders of the token on non-Ethereum deployments are facing uncertainty about the value of their tokens, potentially triggering a wave of panic redemptions. This has already led to Aave, SparkLend, and Fluid freezing their rsETH markets, with AAVE's price falling by around 10%. Lido Finance has also paused deposits into its earnETH product due to its exposure to rsETH. The incident is being investigated by Kelp DAO, LayerZero, and security specialists, with the goal of recovering the stolen funds and preventing further losses. The attack is the latest in a series of DeFi exploits, including the $285 million theft from Solana-based Drift, and highlights the ongoing security risks in the DeFi space.