Kelp DAO Suffers $292 Million Exploit

A significant exploit occurred over the weekend, with a cross-chain bridge being drained of approximately $292 million worth of rsETH. This incident involved an attacker tricking the LayerZero cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. Kelp DAO, a liquid restaking protocol, had its emergency pauser multisig freeze the protocol's core contracts 46 minutes after the successful drain. The attacker attempted two follow-up drains, which were reverted. This exploit has been linked to North Korea, suggesting an evolution in the nation's hacking strategies, focusing on manipulating data and exploiting decentralized system assumptions rather than seeking bugs or stolen credentials. The aftermath of the Kelp DAO hack has also affected Aave, with the attacker depositing compromised rsETH as collateral and borrowing approximately $190 million in ETH and related assets. Aave has since frozen rsETH markets and set loan-to-value ratios to zero to contain the risk. Furthermore, Coinbase has commissioned a report highlighting the potential risks of quantum computing to the crypto industry, emphasizing the need for preparation despite current blockchains remaining secure.