Kelp DAO Exploit Results in $292 Million Loss Attributed to North Korean Lazarus Group

This incident underscores vulnerabilities in decentralized finance (DeFi) infrastructure, potentially shaking investor confidence and liquidity across the ecosystem.

• On April 18, 2026, Kelp DAO's LayerZero-powered rsETH bridge was exploited, draining 116,500 rsETH tokens valued at approximately $292 million.
• Attackers compromised RPC nodes and exploited a single decentralized verifier network configuration to approve a forged cross-chain message.
• Kelp DAO paused bridge contracts after the exploit, but not before attackers borrowed over $236 million in WETH and ETH on Aave.

• Kelp DAO operates a liquid restaking protocol that issues rsETH, a token backed by staked ETH, facilitating yields across chains via LayerZero's interoperability protocol.
• LayerZero employs decentralized verifier networks (DVNs) for cross-chain message validation, with multi-verifier consensus recommended over single-verifier setups.
• North Korean state actors, particularly the Lazarus Group, have escalated cryptocurrency thefts, amassing billions since 2022, including a recent $285 million exploit on Drift Protocol.

On April 18, 2026, between 10:20 a.m. and 11:40 a.m. PT, a sophisticated attack unfolded against Kelp DAO's rsETH bridge. Attackers targeted two RPC nodes that were integral to LayerZero's decentralized verifier network (DVN). By installing malicious binaries, they were able to falsify data selectively, creating a scenario where the DVN could be misled into approving a forged cross-chain message.

Compounding the issue, a Distributed Denial of Service (DDoS) attack on uncompromised nodes forced a failover to the compromised infrastructure. This led to Kelp DAO's 1-of-1 DVN configuration approving the forged message, which resulted in the minting of 116,500 unbacked rsETH tokens worth $292 million.

The attackers quickly moved to capitalize on their ill-gotten gains, depositing the minted tokens as collateral on Aave V3/V4. Within just 46 minutes, they borrowed over $236 million in WETH and ETH, showcasing the speed and efficiency of the exploit. Kelp DAO's multisig governance paused bridge contracts shortly after the exploit, blocking two subsequent attempts to withdraw an additional $200 million.

LayerZero published a post-mortem on April 20, attributing the attack