Massive Crypto Heist: Kelp DAO Loses $292 Million in rsETH as Attacker Exploits LayerZero-Powered Bridge

In a shocking turn of events, a malicious actor has successfully drained a staggering 116,500 rsETH, representing roughly 18% of the token's circulating supply, from Kelp DAO's LayerZero-powered bridge, triggering a chain reaction of emergency responses across the DeFi landscape. The attack, which occurred at 17:35 UTC on Saturday, exploited a vulnerability in LayerZero's cross-chain messaging layer, deceiving the system into releasing the valuable tokens to an attacker-controlled address. This brazen heist has left the DeFi community reeling, with the stolen funds valued at approximately $292 million at current market prices. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield on top of standard Ethereum staking rewards, issuing rsETH as a tradeable receipt to users. The breached bridge held the reserve backing wrapped versions of the token deployed across over 20 different blockchains, including prominent networks like Base, Arbitrum, and Scroll. The attacker cleverly manipulated LayerZero's infrastructure, tricking it into believing a legitimate instruction had been received from another network, thereby triggering the release of the valuable rsETH tokens. Kelp's emergency response team sprang into action, freezing the protocol's core contracts a mere 46 minutes after the successful drain, at 18:21 UTC. However, the drama did not end there, as two subsequent attempts were made to drain an additional 40,000 rsETH, worth roughly $100 million, at 18:26 UTC and 18:28 UTC, respectively. Fortunately, both attempts were thwarted, with the LayerZero packets being reverted. The far-reaching implications of this attack are still unfolding, with rsETH holders on non-Ethereum deployments facing uncertainty regarding the value of their tokens. This has created a feedback loop, where panic redemptions on layer 2 blockchains are putting pressure on the unaffected Ethereum supply, potentially forcing Kelp to unwind restaking positions to honor withdrawals. The list of affected parties continues to grow, with Aave, SparkLend, and Fluid all freezing their rsETH markets in response to the exploit. Aave's founder, Stani Kulechov, confirmed that the attack was external and did not compromise Aave's contracts. The AAVE token suffered a 10% decline as the market digested the potential bad debt. Lido Finance, another major player, paused further deposits into its earnETH product, which carries rsETH exposure, while emphasizing that stETH and wstETH are unaffected and the core Lido staking protocol is not involved in the incident. Ethena, a stablecoin issuer, temporarily paused its LayerZero OFT bridges from the Ethereum mainnet as a precautionary measure, citing no rsETH exposure and a high level of overcollateralization. The pause is expected to last approximately six hours while the root cause is identified. Kelp, a product under the KernelDAO umbrella, publicly acknowledged the incident, stating that it is investigating the matter with LayerZero, Unichain, its auditors, and outside security specialists. The protocol has not disclosed the specifics of how the exploit bypassed the bridge's validation logic. As the DeFi community navigates this treacherous landscape, the fate of rsETH's peg hangs in the balance, dependent on the extent of cross-chain redemptions into ETH on Ethereum and Kelp's ability to recover any portion of the stolen funds before the trail goes cold. This high-profile attack comes amidst an already tumultuous period for DeFi, with Solana-based perpetuals protocol Drift suffering a $285 million loss on April 1, attributed to North Korea-affiliated actors, and at least a dozen smaller protocols falling victim to exploits in recent weeks. The Kelp DAO incident now stands as the largest DeFi exploit of 2026, surpassing Drift by a few million dollars, and serves as a stark reminder of the ever-present threats and vulnerabilities in the DeFi ecosystem.