Nearly $300M stolen from Kelp DAO cross-chain bridge heist

Cybernews reports that major liquid restaking protocol Kelp DAO had 116,500 rsETH, or almost $292 million, stolen following an attack against its LayerZero-powered cross-chain bridge on Apr. 18, surpassing the over $280 million losses recorded from the crypto heist against Solana-based decentralized finance exchange Drift Protocol.

Allowing the illicit transfer of funds was the delivery of a fraudulent cross-network message that was recognized as a valid instruction. Two more attempts by the attacker to pilfer an additional $100 million after Kelp DAO froze its platform were thwarted.

"We identified suspicious cross-chain activity involving rsETH. We have paused rsETH contracts across mainnet and several L2s while we investigate," said Kelp DAO in a post on X. Such an intrusion has prompted Aave, which is the largest DeFi lending protocol, to freeze its rsETH markets. However, Aave founder Stani Kulechov emphasized that none of the platform's contracts were impacted by the external exploit.

"Freezing the rsETH markets prevents new deposits and borrowing against rsETH collateral while the situation is assessed," noted Aave.