Major Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

In a shocking turn of events, an attacker successfully drained approximately 116,500 rsETH, equivalent to about 18% of the circulating supply, from Kelp DAO's LayerZero-powered bridge. This significant breach, valued at roughly $292 million, has triggered a wave of panic across the DeFi landscape. The attack, which occurred on Saturday at 17:35 UTC, involved the exploitation of LayerZero's cross-chain messaging layer, allowing the perpetrator to trick the system into releasing the substantial amount of rsETH to an attacker-controlled address. The stolen funds were part of a reserve backing wrapped versions of the token deployed across more than 20 blockchains, including prominent networks such as Base, Arbitrum, and Scroll. As a result, holders of rsETH on non-Ethereum deployments are now faced with uncertainty regarding the validity of their tokens, sparking concerns of potential panic redemptions and further market instability. In response to the incident, several major DeFi platforms, including Aave, SparkLend, and Fluid, have frozen their rsETH markets to mitigate potential losses. Furthermore, Lido Finance has paused deposits into its earnETH product, citing rsETH exposure, while Ethena has temporarily halted its LayerZero OFT bridges as a precautionary measure. The Kelp DAO team, in collaboration with LayerZero, Unichain, auditors, and external security experts, is currently investigating the incident, aiming to identify the root cause and potentially recover the stolen funds. The aftermath of this significant exploit is being closely monitored, with the stability of rsETH and the broader DeFi ecosystem hanging in the balance.