On Saturday at 17:35 UTC, an attacker called the lzReceive function on LayerZero’s EndpointV2 contract and forged a cross-chain message. Kelp DAO’s bridge believed it. It released 116,500 rsETH, roughly $292 million, about 18% of the token’s entire circulating supply, to an attacker-controlled address. Forty-six minutes later Kelp’s emergency multisig froze the contracts. Two follow-up … Continue reading Someone Warned Kelp DAO About This Exact Vulnerability 15 Months Ago. Nobody Listened. $292 Million Is Gone