Kelp DAO Suffers $292 Million Crypto Heist, Leaving 20 Blockchains Vulnerable

In a devastating blow to the DeFi sector, an attacker has successfully drained approximately $292 million from Kelp DAO's LayerZero-powered bridge, compromising nearly a fifth of the circulating supply of restaked ether tokens. The breach occurred on Saturday at 17:35 UTC, with the attacker exploiting a vulnerability in LayerZero's cross-chain messaging layer to trick the bridge into releasing 116,500 rsETH to an attacker-controlled address. As a result, Kelp DAO's emergency pauser multisig was forced to freeze the protocol's core contracts, while several other DeFi platforms, including Aave, SparkLend, and Fluid, have suspended their rsETH markets to mitigate potential losses. With the reserve backing wrapped versions of the token on over 20 networks now depleted, holders of rsETH on non-Ethereum deployments face uncertainty regarding the value of their tokens, sparking fears of a potential panic redemption cycle that could put further pressure on the already reeling DeFi market. The incident has sent shockwaves throughout the industry, with AAVE's price plummeting by around 10% as investors weigh the potential risks of bad debt. In response to the crisis, several prominent DeFi players, including Lido Finance and Ethena, have taken precautionary measures to safeguard their users' assets, while Kelp DAO has launched an investigation into the incident, working closely with LayerZero, Unichain, and external security experts to determine the cause of the breach and recover the stolen funds.