Massive Crypto Heist: $292 Million Stolen from Kelp DAO, Leaving 20 Blockchains Vulnerable

A devastating hack has struck Kelp DAO, a liquid restaking protocol, with an attacker making off with a staggering 116,500 rsETH, equivalent to around $292 million, from the platform's LayerZero-powered bridge. This incident, which occurred on Saturday at 17:35 UTC, has sent shockwaves throughout the DeFi ecosystem, as the stolen funds account for roughly 18% of the total circulating supply of rsETH. The breach has left many wondering about the security of their investments, particularly those holding wrapped versions of the token on over 20 other blockchains, including Base, Arbitrum, and Scroll. The attack was made possible by exploiting LayerZero's cross-chain messaging layer, tricking it into releasing the funds to an attacker-controlled address. In response, Kelp DAO's emergency pauser multisig froze the protocol's core contracts, but not before the attacker attempted two further transactions. The fallout from this incident is widespread, with Aave, SparkLend, and Fluid all freezing their rsETH markets, and Lido Finance pausing further deposits into its earnETH product. As the DeFi community grapples with the implications of this breach, one thing is clear: the security of cross-chain bridges and the tokens they support is under intense scrutiny. With the attacker's methods still unclear, the coming days will be crucial in determining the fate of rsETH and the broader DeFi ecosystem.