Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Exposed

A catastrophic breach occurred on Saturday at 17:35 UTC, when an attacker exploited Kelp DAO's LayerZero-powered bridge, siphoning off approximately $292 million worth of rsETH, a restaked ether token, in a daring heist that has sent shockwaves throughout the DeFi ecosystem. The attacker cleverly manipulated LayerZero's cross-chain messaging system, deceiving it into releasing the substantial amount of rsETH to an attacker-controlled address. The Kelp DAO protocol, which utilizes EigenLayer to generate additional yield for user-deposited ETH, was forced to pause its core contracts 46 minutes later in an attempt to mitigate the damage. However, the fallout is far-reaching, with the attack compromising the reserve backing wrapped versions of rsETH on over 20 blockchains, including Base, Arbitrum, and Scroll, and triggering a wave of panic redemptions that threatens to destabilize the entire DeFi landscape. As a result, prominent platforms such as Aave, SparkLend, and Fluid have been compelled to freeze their rsETH markets, while Lido Finance has paused further deposits into its earnETH product. The incident has also prompted Ethena to temporarily halt its LayerZero OFT bridges as a precautionary measure. With the contagion spreading rapidly, the future of rsETH's peg hangs in the balance, as investors anxiously await the outcome of Kelp's investigation and the potential recovery of the stolen funds.