The 300-Million-Dollar Minute: How a Surgical Bridge Exploit Nearly Drained Kelp DAO
Do Son 
A mundane Saturday evening culminated in a veritable catastrophe for a prominent cryptocurrency initiative. An unidentified adversary orchestrated the exfiltration of hundreds of millions of dollars via a cross-chain bridge, a heist executed with surgical precision in a matter of minutes.
The cyber-marauder siphoned 116,500 rsETH tokens from the Kelp DAO protocol, a haul valued at approximately $292 million at current market valuations. The breach transpired around 17:35 UTC, during which the perpetrator’s wallet invoked the lzReceive function within the LayerZero contract, compelling the bridge to autonomously transfer the assets to a designated address.
This digital treasury was meticulously prepared; approximately ten hours prior to the incursion, the assailant funded the wallet through Tornado Cash, a service frequently utilized within the decentralized finance ecosystem to obfuscate transactional footprints. Blockchain sleuth ZachXBT corroborated that the losses likely eclipsed $280 million, spanning both the Ethereum and Arbitrum networks, and noted that the addresses implicated in the theft share common lineage with Tornado Cash.
The Kelp DAO collective responded within forty-six minutes of the breach, implementing a cessation of operations across primary contracts. This emergency moratorium incapacitated the deposit pool, withdrawal mechanisms, the price oracle, and the rsETH token itself. The team subsequently confirmed the detection of anomalous cross-chain activity and announced the suspension of operations across the mainnet and several Layer 2 environments.
Transactional records indicate the assailant endeavored to perpetuate the assault; however, two subsequent attempts to withdraw an additional 40,000 rsETH—which would have exacerbated the damages by another $100 million—were thwarted by the system’s newly activated defenses. Had the offensive reached total fruition, the aggregate losses would have approached $391 million.
The primary target was the Omnichain Fungible Token (OFT) bridge standard, designed to facilitate the seamless migration of tokens across disparate blockchains. The purloined volume represents roughly 18% of the total circulating supply of rsETH, an asset integrated into over twenty networks including Base, Linea, Blast, Mantle, and Scroll.
The ripples of this incident perturbed the broader ecosystem. The AAVE token suffered a 10% depreciation amidst anxieties that the lending platform might inherit “bad debt.” In response, the Aave team froze rsETH markets across protocol versions V3 and V4, emphasizing that the vulnerability resided within the rsETH architecture rather than their own smart contracts. Aave further declared its intention to scrutinize loans initiated post-attack and explore avenues to remediate any potential fiscal deficits.
Donate