Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO in a Cross-Chain Exploit

A devastating cross-chain bridge hack has left Kelp DAO reeling, with an attacker making off with a staggering $292 million worth of rsETH, roughly 18% of the token's circulating supply. The breach, which occurred on Saturday at 17:35 UTC, saw the attacker trick LayerZero's cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. The fallout has been swift, with multiple DeFi platforms, including Aave, SparkLend, and Fluid, freezing rsETH markets in response to the exploit. The hack has raised concerns about the stability of the DeFi ecosystem, with the value of AAVE plummeting by around 10% in the aftermath. As the situation continues to unfold, Kelp DAO is working to recover the stolen funds and contain the damage, but the incident has already sparked a wave of panic redemptions, putting pressure on the unaffected Ethereum supply and potentially forcing Kelp to unwind restaking positions to honor withdrawals. The exploit has also led to a precautionary pause of LayerZero OFT bridges from Ethereum mainnet by Ethena, and Lido Finance has paused further deposits into its earnETH product, which carries rsETH exposure. With the DeFi space already reeling from a string of high-profile hacks, including the $285 million drain of Solana-based perpetuals protocol Drift, the Kelp DAO incident has raised fresh concerns about the security and resilience of the ecosystem.