Massive Exploit: Kelp DAO Loses $292 Million

Network News A recent exploit has resulted in the loss of approximately $292 million from Kelp DAO, a liquid restaking protocol. This incident occurred when an attacker managed to trick LayerZero's cross-chain messaging layer into releasing 116,500 rsETH (restaked ether) to an attacker-controlled address. The attacker exploited the system by manipulating the data feeding into it, causing it to approve transactions that never actually occurred. This has significant implications for the DeFi space, with Aave being particularly affected as the attacker deposited a substantial amount of rsETH into Aave as collateral and borrowed roughly $190 million in ETH and related assets. Further investigation suggests that North Korea-linked hackers may be responsible for the exploit, indicating an evolution in their tactics. Instead of relying on bugs or stolen credentials, they are now exploiting the basic assumptions built into decentralized systems. This is not an isolated incident, as less than three weeks ago, North Korea-linked hackers used social engineering to hit crypto trading firm Drift. The combined losses from these two incidents exceed $500 million. Aave has taken steps to contain the risk, including freezing rsETH markets and halting new borrowing against the asset. However, the outcome depends largely on how Kelp handles the shortfall. If losses are spread across all rsETH holders, the token may face an estimated 15% depegging, resulting in about $124 million in bad debt for Aave. If losses are instead isolated to Layer 2 networks, the impact would be far more severe, with bad debt rising to roughly $230 million. In related news, Coinbase has commissioned a report on the risks associated with quantum computing. While current blockchains remain secure, the report concludes that a future 'fault-tolerant quantum computer' capable of breaking widely used encryption is increasingly plausible, and preparation must begin now. The report stresses that current quantum machines are far from powerful enough to crack the cryptography underpinning Bitcoin, Ethereum, and other networks, but it is essential to start preparing for potential future risks.