Kelp DAO Suffers $292 Million Exploit via LayerZero Bridge

Kelp DAO, a prominent liquid restaking protocol, has been hit by a massive exploit resulting in the loss of approximately $292 million. The attacker successfully drained 116,500 rsETH from the protocol's LayerZero-powered bridge, a move that compromised nearly a fifth of the token's total circulating supply. The breach occurred when the attacker manipulated LayerZero's cross-chain messaging layer, tricking the system into releasing funds based on forged instructions. This incident appears to be part of a coordinated campaign by North Korea-linked hackers, who recently targeted the trading firm Drift. Combined, these two exploits have siphoned over $500 million from the crypto sector in just over two weeks. The exploit was executed at 17:35 UTC over the weekend. Kelp DAO's emergency multisig froze core contracts 46 minutes later, successfully thwarting two subsequent attempts to drain an additional 80,000 rsETH. The fallout extended rapidly to Aave, where the attacker deposited 89,567 rsETH as collateral to borrow approximately $190 million in ETH and related assets across Ethereum and Arbitrum. In response, Aave Labs moved to contain the risk by freezing rsETH markets and setting loan-to-value ratios to zero, halting all new borrowing against the asset. The long-term stability of the rsETH token now depends on how Kelp DAO manages the resulting shortfall.