Kelp DAO suffers attack with losses of approximately $292 million, Aave states rsETH market has been frozen

According to The Block, on-chain data shows that an attacker on Saturday stole 116,500 rsETH from Kelp DAO's cross-chain bridge based on LayerZero, worth about $292 million at current market prices.
The attacker-controlled wallet called the lzReceive method on the LayerZero EndpointV2 contract, which triggered Kelp's bridging contract to release 116,500 rsETH to another attacker address. The attacker's wallet obtained funds via Tornado Cash about 10 hours ago.
Kelp DAO posted on X platform stating that suspicious cross-chain activity involving rsETH has been identified, and the mainnet and multiple L2 rsETH contracts have been suspended. They are collaborating with LayerZero, Unichain, and security experts to analyze the root cause.
Aave immediately froze the rsETH markets on V3 and V4 and stated that they will explore compensation options if bad debts arise; the AAVE token price dropped about 10% following the incident. This is the second security incident involving Kelp within approximately a year; in April last year, an exploit in the fee contract led to over-minting of rsETH, but no user funds were lost at that time.