Crypto Exploit of 2026: $292 Million Stolen from Kelp DAO, Leaving Wrapped Ether Stranded Across 20 Chains

A significant exploit has occurred in the DeFi space, with an attacker managing to drain nearly a fifth of the circulating supply of a restaked ether token from a cross-chain bridge, prompting a rapid response from various platforms to mitigate the fallout. The breach, which happened on Saturday at 17:35 UTC, involved the theft of 116,500 rsETH from Kelp DAO's LayerZero-powered bridge, valued at roughly $292 million at current prices. This represents about 18% of the token's 630,000 circulating supply. The bridge in question held the rsETH reserve that backed wrapped versions of the token deployed across more than 20 other blockchains. The attacker successfully tricked LayerZero's cross-chain messaging layer into releasing 116,500 rsETH to an attacker-controlled address. In response, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain. The aftermath of the exploit has seen a ripple effect across the DeFi ecosystem, with several platforms taking precautionary measures. Aave, for instance, froze rsETH markets on V3 and V4, while SparkLend and Fluid also froze their rsETH markets. The impact on the market has been notable, with AAVE experiencing a 10% drop as the market adjusts to the potential bad debt. Lido Finance has paused further deposits into its earnETH product due to rsETH exposure, although it clarified that stETH and wstETH are unaffected. Ethena temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure, citing no rsETH exposure and over 101% overcollateralization. The incident highlights the ongoing challenges in the DeFi space, particularly in the context of cross-chain bridges and the potential vulnerabilities they may introduce. As the situation unfolds, the focus will be on how Kelp DAO and affected platforms respond to the exploit and work towards recovering the stolen funds.