Overview
- An attacker drained 116,500 rsETH worth about $292 million from Kelp DAO’s LayerZero bridge, removing roughly 18% of the token’s supply.
- The bridge held the reserve that backed wrapped rsETH on over 20 networks, leaving many cross‑chain versions with uncertain support.
- Investigators say a spoofed LayerZero message tricked the bridge into releasing funds, and Kelp said it has activated pauses and is working with LayerZero, Unichain, auditors, and outside security firms.
- Aave froze rsETH markets and reported no breach of its own contracts, with SparkLend, Fluid, and Lido also pausing products tied to rsETH to limit spillover risk.
- The incident is 2026’s largest DeFi hack so far, edging past the Drift Protocol theft reported earlier this month.