Kelp DAO Suffers Attack, Loses Approximately $292 million, Aave States rETH Market Has Been Frozen

April 19th, per a report from The Block, on-chain data shows an attacker stole 116,500 rsETH—valued at roughly $292 million at current market rates—from Kelp DAO’s LayerZero-powered cross-chain bridge on Saturday. The attacker’s controlled wallet invoked the `lzReceive` method on LayerZero’s EndpointV2 contract, prompting Kelp’s bridging contract to release the 116,500 rsETH to a secondary attacker address. Approximately 10 hours before the theft, funds had been sent to the attacker’s wallet via Tornado Cash. On-chain sleuth ZachXBT noted: “KelpDAO was reportedly hacked for over $280 million roughly an hour ago across Ethereum and Arbitrum; the attacker’s address received funds through Tornado Cash.” Kelp DAO tweeted it has identified suspicious cross-chain activity involving rsETH and has paused the rsETH contract on mainnet and multiple Layer 2 networks. It is conducting a root cause analysis in collaboration with LayerZero, Unichain, and security experts. Aave promptly froze rsETH markets on its V3 and V4 protocols and said it would explore compensation solutions for any resulting losses. The AAVE token price dropped roughly 10% following the incident. This marks Kelp’s second security incident in roughly a year. Last April, an rsETH over-minting issue occurred due to a flaw in the fee contract—but no user funds were lost at that time.