Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating cyber attack has drained nearly 18% of the circulating supply of restaked ether tokens from Kelp DAO's cross-chain bridge, sparking a frantic response across the DeFi ecosystem. On Saturday, at 17:35 UTC, an attacker exploited a vulnerability in LayerZero's cross-chain messaging layer, tricking the bridge into releasing 116,500 rsETH to a malicious address. The stolen tokens, valued at around $292 million, were part of a reserve backing wrapped versions of the token on over 20 other blockchains. The attack has triggered a chain reaction, with Aave, SparkLend, and Fluid freezing their rsETH markets and Lido Finance pausing further deposits into its earnETH product. The incident has also raised concerns about the potential for panic redemptions and the impact on the Ethereum supply. As the situation continues to unfold, the DeFi community is left to ponder the implications of this massive exploit and the potential consequences for the affected platforms and their users.