Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Chains with Stranded Wrapped Ether

A devastating breach has occurred in the DeFi space, with an attacker successfully draining 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply, from Kelp DAO's cross-chain bridge. The exploit, which took place on Saturday at 17:35 UTC, has sent shockwaves throughout the cryptocurrency community, triggering a series of emergency measures to mitigate the damage. The attacker exploited a vulnerability in LayerZero's cross-chain messaging layer, tricking the system into releasing the rsETH to an attacker-controlled address. As a result, the reserve backing wrapped versions of the token on over 20 other blockchains has been depleted, leaving holders on non-Ethereum deployments uncertain about the value of their tokens. The fallout is being felt across the DeFi ecosystem, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. The incident has also led to a significant decline in the value of AAVE, with the token falling by approximately 10% as the market reacts to the potential bad debt. Kelp DAO has acknowledged the incident and is working with LayerZero, Unichain, and security specialists to investigate the breach and recover the stolen funds. The situation is being closely monitored, with the potential for further contagion and instability in the DeFi space.