Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 18% of rsETH Supply Drained Across 20 Blockchains

A devastating exploit has struck Kelp DAO, a liquid restaking protocol, with an attacker making off with 116,500 rsETH, valued at approximately $292 million. This substantial loss accounts for nearly 18% of the token's total circulating supply. The breach occurred on Saturday at 17:35 UTC, leveraging LayerZero's cross-chain messaging layer to deceive Kelp's bridge into releasing the funds to an attacker-controlled address. The affected bridge held the rsETH reserve that backed wrapped versions of the token on over 20 other blockchains, including Base, Arbitrum, and Scroll. Following the incident, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later. However, two subsequent attempts to drain an additional 40,000 rsETH were thwarted. The aftermath has seen a ripple effect across DeFi, with Aave, SparkLend, and Fluid freezing their rsETH markets. Lido Finance has also paused further deposits into its earnETH product due to rsETH exposure. The exploit's impact on the market has been significant, with AAVE experiencing a 10% decline. As the situation unfolds, the potential for further contagion and the fate of rsETH's peg hang in the balance, making it a critical period for the DeFi space.