Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating hack has struck the DeFi world, with an attacker making off with a staggering $292 million in restaked ether (rsETH) from Kelp DAO's LayerZero-powered bridge. The breach, which occurred on Saturday at 17:35 UTC, saw the thief exploit a vulnerability in the cross-chain messaging layer to trick the bridge into releasing 116,500 rsETH to an attacker-controlled address. This represents a significant 18% of the token's circulating supply. The incident has sent shockwaves through the DeFi ecosystem, with several major platforms, including Aave, SparkLend, and Fluid, swiftly freezing their rsETH markets in response. The attack has also raised concerns about the potential for a broader contagion, as the stolen rsETH was held in a reserve backing wrapped versions of the token on over 20 different blockchains. As the situation continues to unfold, market participants are bracing for potential further fallout, with the price of AAVE already taking a hit, falling around 10% in the aftermath of the exploit. Lido Finance has also taken precautionary measures, pausing further deposits into its earnETH product, which has exposure to rsETH. The Kelp DAO incident is the latest in a string of high-profile DeFi hacks, including the $285 million heist from Solana-based perpetuals protocol Drift on April 1, and highlights the ongoing risks and challenges facing the DeFi space.