Major Crypto Heist: $292 Million Stolen from Kelp DAO, Disrupting DeFi Ecosystem

A significant breach has occurred in the DeFi space, with an attacker successfully draining 116,500 rsETH, equivalent to around 18% of the token's circulating supply, from Kelp DAO's LayerZero-powered bridge. This incident has far-reaching implications, affecting numerous platforms and prompting urgent responses to mitigate potential damage. The breach, which took place on Saturday at 17:35 UTC, saw the attacker exploit LayerZero's cross-chain messaging layer, tricking it into releasing the substantial amount of rsETH to an attacker-controlled address. The stolen tokens are valued at approximately $292 million at current market prices. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield on top of standard Ethereum staking rewards, issuing rsETH as a tradeable receipt to users. The drained bridge held the rsETH reserve that backed wrapped versions of the token deployed on over 20 other blockchain networks. Following the incident, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes later, at 18:21 UTC. However, two subsequent attempts to drain an additional 40,000 rsETH, worth around $100 million, were reverted. The impact of this breach is widespread, with rsETH being deployed across more than 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll. The drained reserve backed wrapped versions of the token on every layer 2 blockchain, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. This has created a feedback loop, where panic redemptions on layer 2 blockchains could pressure the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The list of affected platforms continues to grow, with Aave, SparkLend, and Fluid already freezing their rsETH markets in response to the exploit. The AAVE token price dropped by around 10% as the market factored in potential bad debt. Lido Finance has paused further deposits into its earnETH product, which carries rsETH exposure, while Ethena has temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure. Kelp, a product under the KernelDAO umbrella, has acknowledged the incident and is investigating the breach with LayerZero, Unichain, its auditors, and outside security specialists. The protocol's ability to recover any portion of the stolen funds and maintain the peg of rsETH through the weekend remains uncertain. This major heist occurs during a particularly challenging period for DeFi, following a series of smaller exploits and the significant breach of Solana-based perpetuals protocol Drift, which lost around $285 million on April 1. The Kelp DAO incident is now the largest DeFi exploit of 2026, surpassing Drift by a few million dollars.