Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchain Networks Vulnerable

A staggering $292 million worth of restaked ether was drained from a cross-chain bridge, sparking a crisis that is rapidly spreading throughout the DeFi ecosystem, as Kelp DAO struggles to contain the damage and prevent further losses. The attack, which occurred on Saturday at 17:35 UTC, exploited a vulnerability in LayerZero's cross-chain messaging layer, allowing the thief to trick the system into releasing 116,500 rsETH to an attacker-controlled address. Kelp DAO, a liquid restaking protocol, utilizes EigenLayer to generate additional yield on top of standard Ethereum staking rewards, issuing rsETH as a tradeable receipt to users. The breached bridge held the rsETH reserve that backed wrapped versions of the token deployed across over 20 blockchain networks. The attacker's strategy involved deceiving LayerZero's cross-chain messaging layer into believing a legitimate instruction had been received from another network, thereby triggering the release of the rsETH to the attacker's address. In response to the incident, Kelp's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain. However, two subsequent attempts to drain an additional 40,000 rsETH, worth approximately $100 million, were reverted. The rsETH token is currently deployed on more than 20 networks, including Base, Arbitrum, Linea, Blast, Mantle, and Scroll, with LayerZero's OFT standard facilitating cross-chain movement. As a result of the drained reserve, holders of wrapped rsETH on non-Ethereum deployments are now facing uncertainty regarding the value of their tokens, creating a potential feedback loop where panic redemptions on layer 2 blockchains could pressure the unaffected Ethereum supply, forcing Kelp to unwind restaking positions to honor withdrawals. The list of affected platforms continues to grow, with Aave, SparkLend, and Fluid freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product due to its exposure to rsETH. AAVE's value plummeted by approximately 10% as the market accounted for potential bad debt. Ethena, a stablecoin issuer, temporarily paused its LayerZero OFT bridges from Ethereum mainnet as a precautionary measure, stating that it has no rsETH exposure and remains over 101% overcollateralized. Kelp, a product under the KernelDAO umbrella, publicly acknowledged the incident and is currently investigating the exploit with LayerZero, Unichain, its auditors, and outside security specialists. The protocol has not disclosed the specifics of how the attack bypassed the bridge's validation logic. The fate of rsETH's peg over the weekend remains uncertain, dependent on the extent of cross-chain redemptions into ETH on Ethereum and Kelp's ability to recover the stolen funds before the trail goes cold. This hack occurs during a particularly challenging period for DeFi, following the $285 million drain of Solana-based perpetuals protocol Drift on April 1, which was later linked to North Korea-affiliated actors, and at least a dozen smaller protocols have been exploited in recent weeks, including CoW Swap, Zerion, Rhea Finance, and Silo Finance. The $292 million loss suffered by Kelp DAO now represents the largest DeFi exploit of 2026, surpassing the Drift incident by a few million dollars.