Crypto's Biggest Heist of 2026: $292 Million Stolen from Kelp DAO, Leaving 20 Chains with Stranded Wrapped Ether

A devastating cyber attack has struck Kelp DAO, a liquid restaking protocol, resulting in the theft of 116,500 rsETH, equivalent to roughly 18% of the token's circulating supply. This cross-chain bridge, which utilizes LayerZero's messaging layer to facilitate communication between different blockchains, was compromised when the attacker deceived the system into releasing the funds to a controlled address. The stolen rsETH was the reserve backing wrapped versions of the token deployed across more than 20 networks, including Base, Arbitrum, and Scroll. As a result, holders of these wrapped tokens are now facing uncertainty regarding the value of their assets. The fallout from this incident has been swift, with Aave, SparkLend, and Fluid freezing their rsETH markets and Lido Finance pausing further deposits into its earnETH product. The attack has also triggered a wave of panic redemptions, which may pressure Kelp to unwind its restaking positions to honor withdrawals, potentially leading to a broader contagion in the DeFi market.