Kelp DAO bridge drained of 116,500 rsETH in exploit

An attacker moved 116,500 rsETH from Kelp DAO's LayerZero-powered cross-chain bridge at 17:35 UTC on Saturday, according to on-chain transaction records. At about $2,500 per token, the withdrawal equals roughly $292 million.

The drain happened when a wallet identified as lzReceive called LayerZero's EndpointV2 contract, triggering Kelp’s bridge contract to release the tokens to an attacker address, according to event logs.

Blockchain records show the attacker-funded wallet received funds about 10 hours earlier through Tornado Cash's 1 ETH pool, a tool commonly used to obscure transaction origins. The stolen 116,500 rsETH represents about 18% of rsETH's circulating supply, which market trackers list at roughly 630,000 tokens.

Kelp DAO’s emergency pauser multisig executed a pauseAll command at 18:21 UTC, roughly 46 minutes after the withdrawal. The pause generated Paused events across the protocol’s core contracts, including the liquid restaking token deposit pool, the withdrawal contract, the LRT oracle and the rsETH token contract.

Two follow-up attempts by the attacker at 18:26 UTC and 18:28 UTC were reverted, indicating the pause prevented further token releases.

The exploit targeted Kelp’s LayerZero OFT bridge, which moves rsETH across multiple networks. rsETH is deployed on more than 20 blockchains, including Base, Arbitrum, Linea, Blast, Mantle and Scroll.

Blockchain anonymous analyst ZachXBT posted on Telegram: “KelpDAO appears to have had $280M+ stolen one hour ago on Ethereum and Arbitrum.” Market data showed a drop in related token prices after the incident, including about a 10% decline in AAVE's price.

Kelp DAO experienced a separate issue in April 2025 when a fee-contract bug led to unintended rsETH minting; the protocol paused deposits and withdrawals at that time and reported no user funds lost. The current incident is under investigation by on-chain analysts and the protocol team. Kelp DAO and Kernel DAO had not posted a formal statement on their public channels at the time of publication.