Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Blockchains

In a devastating blow to the DeFi community, an attacker has successfully drained 116,500 rsETH, approximately 18% of the token's circulating supply, from Kelp DAO's LayerZero-powered bridge, worth roughly $292 million. The attack occurred on Saturday at 17:35 UTC, with the attacker exploiting a vulnerability in LayerZero's cross-chain messaging layer to trick the bridge into releasing the funds to an attacker-controlled address. The fallout from the attack is being felt across the DeFi ecosystem, with Aave, SparkLend, and Fluid freezing their rsETH markets and Lido Finance pausing further deposits into its earnETH product. The incident has also led to a significant decline in the value of AAVE, with the token falling by around 10% as the market prices in potential bad debt. As the investigation into the attack continues, the DeFi community is left to ponder the potential long-term consequences of this massive exploit, which has already been dubbed the largest DeFi exploit of 2026.