2026's Largest Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Chains with Stranded Wrapped Ether

A devastating breach occurred on Saturday when an attacker exploited Kelp DAO's LayerZero-powered bridge, draining approximately 18% of the circulating supply of restaked ether, worth around $292 million. The incident has sent shockwaves throughout the DeFi ecosystem, with numerous platforms taking swift action to mitigate potential losses. The attacker manipulated LayerZero's cross-chain messaging system, deceiving it into releasing 116,500 rsETH to a malicious address. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts, but not before two follow-up attempts were made to drain an additional 40,000 rsETH. The stolen rsETH was part of a reserve backing wrapped versions of the token on over 20 networks, including Base, Arbitrum, and Scroll. As a result, holders of rsETH on non-Ethereum deployments are now uncertain about the value of their tokens, sparking a potential crisis of confidence. Aave, SparkLend, and Fluid have all frozen rsETH markets, while Lido Finance has paused further deposits into its earnETH product due to exposure to the affected token. The incident has far-reaching implications for the DeFi sector, which is already reeling from a series of high-profile exploits in recent weeks. The largest of these was the $285 million heist from Solana-based perpetuals protocol Drift, which was linked to North Korea-affiliated actors. Kelp DAO is working with LayerZero, Unichain, and security specialists to investigate the incident and determine the best course of action to recover the stolen funds.