{"investigation":{"slug":"kelp","entity_name":"Kelp","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"Kelp (also known as Kelp DAO) is a liquid restaking protocol built on Ethereum and EigenLayer that issues rsETH, a liquid restaked token. In April 2026 the protocol suffered the largest DeFi exploit of 2026 to date when attackers, attributed to North Korea's Lazarus Group, drained approximately $292 million in rsETH through a compromised LayerZero cross-chain bridge configuration. The protocol and an industry coalition dubbed DeFi United are actively working to restore collateral and resume operations as of May 2026.","sections":[{"content":"Kelp DAO is a liquid restaking protocol launched in late 2023, built on top of EigenLayer on the Ethereum network. The protocol issues rsETH — a Liquid Restaked Token (LRT) — in exchange for user deposits of ETH or liquid staking tokens (LSTs) such as stETH, rETH, and cbETH. rsETH accrues both staking and restaking rewards and is deployable across 40+ DeFi platforms, giving depositors liquidity that conventional restaking does not provide.\n\nKelp is developed by KernelDAO, the parent entity. Prior to Kelp, the founding team co-founded Stader Labs, a multichain liquid staking platform that managed over $1 billion in staked assets. The protocol raised $9 million in a private token round at a $90 million fully diluted valuation in early 2024, with SCB Limited and Laser Digital (Nomura's crypto unit) leading the round alongside Bankless Ventures, Hypersphere Ventures, Draper Dragon, DACM, GSR, HTX Ventures, and DWF Ventures. At its peak the protocol held over $2 billion in total value locked (TVL).","heading":"Background","sources":[{"url":"https://kelp.gitbook.io/kelp","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation","name":"","type":"other","credibility":3},{"url":"https://nansen.ai/post/what-is-kelp-dao","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Users deposit ETH or LSTs into Kelp's smart contracts, receiving rsETH in return. Kelp delegates these assets to EigenLayer operators, earning additional restaking rewards on top of base staking yields. Kelp charges a 10% fee on rewards from ETH deposits; no fee is charged on LST deposits beyond gas.\n\nrsETH is designed to be transferable and usable as collateral across DeFi platforms. Cross-chain functionality was implemented via LayerZero's Omnichain Fungible Token (OFT) standard, allowing rsETH to exist on multiple EVM networks via a lockbox/bridge architecture. Following the April 2026 exploit, Kelp announced migration from LayerZero OFT to Chainlink's Cross-Chain Interoperability Protocol (CCIP), making it the first major protocol to leave LayerZero after the incident.","heading":"Protocol Mechanics","sources":[{"url":"https://kelp.gitbook.io/kelp","name":"","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/05/06/kelpdao-blames-layerzero-shifts-to-chainlinks-ccip-after-292m-hack/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"**Prior Audits**\n\nBefore the April 2026 exploit, Kelp's smart contracts were audited by Sigma Prime (multiple rounds including withdrawal coverage), Code4rena (public audit, November 2023), and MixBytes. All published audits focused on smart contract correctness and did not evaluate off-chain infrastructure configuration or cross-chain bridge operational security.\n\n**April 2025 Fee Contract Bug**\n\nIn April 2025, Kelp disclosed a bug in its fee minter contract introduced during an upgrade that caused excess rsETH to be minted to the protocol's fee address. Kelp paused deposits and withdrawals as a precaution. The protocol stated that no user funds were lost and that all funds remained safe on smart contracts. Aave's governance forum documented a precautionary freezing of rsETH on April 30, 2025 in response.\n\n**April 2026 Bridge Exploit — $292 Million (Critical)**\n\nOn April 18, 2026, Kelp suffered the largest DeFi exploit of 2026 to date. Attackers drained approximately $292 million (116,500 rsETH) through Kelp's LayerZero-powered cross-chain bridge. The exploit was attributed to North Korea's Lazarus Group (specifically the TraderTraitor subgroup) by both LayerZero and blockchain analytics firm Chainalysis.\n\nThe root cause was an architectural vulnerability: Kelp's bridge used a 1-of-1 Decentralized Verifier Network (DVN) configuration — a single node responsible for verifying all cross-chain messages. Attackers compromised two internal RPC nodes operated by LayerZero Labs, then simultaneously DDoS-attacked all external RPC nodes. With legitimate verification infrastructure offline, the sole verifier was forced to rely entirely on attacker-controlled nodes, which fed falsified data indicating rsETH had been burned on the source chain (Unichain) when no burn had occurred. The verifier approved the fraudulent message, releasing 116,500 rsETH on Ethereum to attacker-controlled accounts.\n\nKelp detected the anomaly and paused contracts, reportedly blocking a follow-up $95 million theft attempt. On April 20, 2026, the Arbitrum Security Council froze approximately 30,766 ETH (worth ~$71 million) of attacker funds in coordination with law enforcement. Multiple lending platforms including Aave, SparkLend, and Fluid froze their rsETH markets. Over $13 billion in TVL exited DeFi platforms in the two days following the hack.\n\n**Blame Dispute with LayerZero**\n\nFollowing the exploit, Kelp DAO publicly alleged that LayerZero's default onboarding settings and documentation effectively guided developers toward the vulnerable 1-of-1 DVN configuration, and that LayerZero personnel had directly approved the bridge configuration that was later blamed for the exploit. On May 9, 2026, LayerZero acknowledged it \"made a mistake\" in allowing its verification infrastructure to be used in this configuration for high-value asset bridges.","heading":"Security & Audits","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026","name":"","type":"other","credibility":3},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2026/04/19/2026s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"","type":"other","credibility":3},{"url":"https://governance.aave.com/t/rseth-precautionary-freezing-30-04-2025/21925","name":"","type":"other","credibility":3},{"url":"https://x.com/KelpDAO/status/1917503028267213270","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","name":"","type":"other","credibility":3},{"url":"https://kelp.gitbook.io/kelp/audits","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Kelp DAO was co-founded by Amitej Gajjala and Dheeraj Borra, who previously co-founded Stader Labs together.\n\n**Amitej Gajjala** holds an MBA from IIM Calcutta and a Bachelor's in Electrical and Electronics Engineering from IIT Madras. He previously held strategic roles at Swiggy and A.T. Kearney. At Stader Labs he managed over $1 billion in staked assets before pivoting to Kelp.\n\n**Dheeraj Borra** holds a Bachelor's in Computer Science from IIT Kharagpur and a Master's from The University of Texas at Austin. He previously held engineering roles at LinkedIn and Blend Labs with a focus on large-scale distributed systems.\n\nNo public allegations of misconduct, fraud, or anonymous team concerns have been identified in available sources. The founders have maintained public profiles and have communicated publicly throughout the April 2026 exploit and recovery period. The protocol operates under the KernelDAO umbrella, with governance intended to be conducted via the KELP token (privately sold in 2024, not yet publicly launched at time of the exploit).","heading":"Team & Ownership","sources":[{"url":"https://iq.wiki/wiki/amitej-gajjala","name":"","type":"other","credibility":3},{"url":"https://theorg.com/org/kelp-dao/org-chart/dheeraj-borra","name":"","type":"other","credibility":3},{"url":"https://www.theblockbeats.info/en/news/53822","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"No formal regulatory actions by the SEC, CFTC, DOJ, or other government bodies against Kelp DAO, KernelDAO, or their founders have been identified in available sources as of May 2026.\n\nFollowing the April 2026 exploit, the Arbitrum Security Council issued a restraining notice on attacker funds, creating a legally complex situation in which a decentralized governance council's freeze intersects with potential law enforcement proceedings related to the Lazarus Group attribution. The Cryptopolitan reported that North Korea-linked creditors have taken steps to target frozen Kelp DAO funds, though no court judgments or formal enforcement actions against the protocol itself have been confirmed.\n\nThe protocol operates across multiple jurisdictions without a disclosed principal regulatory domicile. The KELP governance token was privately sold in 2024 and has not been publicly launched; no known regulatory scrutiny of the token offering has been reported.","heading":"Regulatory Status","sources":[{"url":"https://www.cryptopolitan.com/north-korea-creditors-target-kelp-dao-funds/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Kelp presents elevated risk across several dimensions as of May 2026:\n\n**Catastrophic Security Incident**: The April 2026 exploit resulted in the loss of approximately $292 million in user-deposited rsETH. This is the largest DeFi security breach of 2026 to date and ranks among the largest protocol exploits in DeFi history. The attack was carried out by North Korea's Lazarus Group — a sophisticated state-sponsored threat actor — using a combination of compromised infrastructure and DDoS techniques rather than a direct smart contract vulnerability. This is significant because the audited smart contracts were not themselves the vector; the vulnerability lay in off-chain infrastructure configuration.\n\n**Architectural Risk**: The 1-of-1 DVN configuration that enabled the exploit reflects a centralized single point of failure in a system designed to be trustless. The choice of this configuration — regardless of who bears responsibility between Kelp and LayerZero — demonstrates that the protocol's cross-chain security posture was inadequate for the value it held.\n\n**Compounding Prior Incident**: The April 2025 fee contract bug (excess rsETH minting during an upgrade), while not resulting in user fund loss, established a pattern of upgrade-related operational risk that predates the major exploit.\n\n**Recovery Uncertainty**: As of May 2026, recovery is ongoing. A DeFi United coalition has pledged approximately 43,000 ETH from multiple protocols to restore rsETH backing. Arbitrum governance has moved to unfreeze $71 million in recovered attacker funds toward the recovery plan. Kelp and Aave announced plans to resume rsETH operations in mid-May 2026. However, the completeness of user recovery has not been confirmed, legal disputes with LayerZero remain unresolved, and attacker funds attributed to Lazarus Group remain largely unrecovered beyond the frozen Arbitrum portion.\n\n**Counterparty Contagion**: The exploit caused $13 billion in TVL to exit DeFi platforms in two days, demonstrating significant systemic contagion risk from Kelp's interconnected position across Aave, SparkLend, Fluid, and other major protocols.","heading":"Risk Assessment","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026","name":"","type":"other","credibility":3},{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"","type":"other","credibility":3},{"url":"https://www.cryptotimes.io/2026/05/13/kelp-dao-aave-set-to-resume-rseth-operations-after-292m-exploit-recovery/","name":"","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack","name":"","type":"other","credibility":3},{"url":"https://www.pymnts.com/cryptocurrency/2026/kelp-dao-293-million-hack-largest-defi-theft-of-2026/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-11","event":"Kelp DAO launches rsETH liquid restaking protocol on Ethereum and EigenLayer; Code4rena public audit completed.","source":"","date_original":"2023-11-01"},{"date":"2024-02","event":"Kelp begins private token round for KELP governance token at $90 million fully diluted valuation.","source":"","date_original":"2024-02-01"},{"date":"2024-03","event":"Kelp closes $9 million private token round led by SCB Limited and Laser Digital (Nomura) with participation from Bankless Ventures, Hypersphere, Draper Dragon, and others.","source":"","date_original":"2024-03-01"},{"date":"2025-04-30","event":"Kelp discloses bug in fee minter contract causing excess rsETH minting; deposits and withdrawals paused. No user funds lost. Aave precautionarily freezes rsETH markets.","source":""},{"date":"2026-04-18","event":"Kelp DAO's LayerZero-powered cross-chain bridge exploited for approximately $292 million (116,500 rsETH). Attack attributed to North Korea's Lazarus Group (TraderTraitor). Kelp pauses contracts, blocking an alleged follow-up $95 million theft attempt.","source":""},{"date":"2026-04-19","event":"Exploit confirmed as largest DeFi hack of 2026. Aave, SparkLend, and Fluid freeze rsETH markets. Over $13 billion in DeFi TVL exits within 48 hours.","source":""},{"date":"2026-04-20","event":"Kelp DAO publicly alleges LayerZero's default configuration settings caused the exploit. Arbitrum Security Council freezes approximately $71 million in attacker funds on Arbitrum.","source":""},{"date":"2026-04-27","event":"DeFi United coalition — including Aave, Lido, EtherFi, Ethena, Mantle, and LayerZero — announces $300 million+ rescue plan to restore rsETH backing and compensate affected users.","source":""},{"date":"2026-05-06","event":"Kelp DAO publishes detailed memo alleging LayerZero personnel directly approved the vulnerable bridge configuration. Kelp announces migration from LayerZero OFT to Chainlink CCIP.","source":""},{"date":"2026-05-09","event":"LayerZero publicly acknowledges it 'made a mistake' in approving the vulnerable verification configuration used by Kelp's bridge.","source":""},{"date":"2026-05-13","event":"Kelp DAO and Aave announce plans to resume rsETH operations as recovery progresses; DeFi United coalition begins phased rsETH collateral restoration.","source":""}],"sources_used":[{"url":"https://kelp.gitbook.io/kelp","name":"","type":"other","archive_url":"http://web.archive.org/web/20260421020016/https://kelp.gitbook.io/kelp","credibility":3,"archive_timestamp":"2026-04-21T02:00:16+00:00"},{"url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://nansen.ai/post/what-is-kelp-dao","name":"","type":"other","archive_url":"http://web.archive.org/web/20260513133031/https://nansen.ai/post/what-is-kelp-dao","credibility":3,"archive_timestamp":"2026-05-13T13:30:31+00:00"},{"url":"https://www.cryptotimes.io/2026/05/06/kelpdao-blames-layerzero-shifts-to-chainlinks-ccip-after-292m-hack/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830034948/https://www.cryptotimes.io/2026/05/06/kelpdao-blames-layerzero-shifts-to-chainlinks-ccip-after-292m-hack/","credibility":3,"archive_timestamp":"2026-08-30T03:49:48+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026","name":"","type":"other","archive_url":"http://web.archive.org/web/20260727012741/https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026","credibility":3,"archive_timestamp":"2026-07-27T01:27:41+00:00"},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260730015225/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":3,"archive_timestamp":"2026-07-30T01:52:25+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/19/2026s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"","type":"other","archive_url":"http://web.archive.org/web/20260619205713/https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","credibility":3,"archive_timestamp":"2026-06-19T20:57:13+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260724213636/https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","credibility":3,"archive_timestamp":"2026-07-24T21:36:36+00:00"},{"url":"https://governance.aave.com/t/rseth-precautionary-freezing-30-04-2025/21925","name":"","type":"other","archive_url":"http://web.archive.org/web/20250928222100/https://governance.aave.com/t/rseth-precautionary-freezing-30-04-2025/21925","credibility":3,"archive_timestamp":"2025-09-28T22:21:00+00:00"},{"url":"https://x.com/KelpDAO/status/1917503028267213270","name":"","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","name":"","type":"other","archive_url":"http://web.archive.org/web/20260422180712/https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","credibility":3,"archive_timestamp":"2026-04-22T18:07:12+00:00"},{"url":"https://kelp.gitbook.io/kelp/audits","name":"","type":"other","archive_url":"http://web.archive.org/web/20260513072433/https://kelp.gitbook.io/kelp/audits","credibility":3,"archive_timestamp":"2026-05-13T07:24:33+00:00"},{"url":"https://iq.wiki/wiki/amitej-gajjala","name":"","type":"other","archive_url":"http://web.archive.org/web/20260114030128/https://iq.wiki/wiki/amitej-gajjala","credibility":3,"archive_timestamp":"2026-01-14T03:01:28+00:00"},{"url":"https://theorg.com/org/kelp-dao/org-chart/dheeraj-borra","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830034006/https://theorg.com/org/kelp-dao?p=dheeraj-borra","credibility":3,"archive_timestamp":"2026-08-30T03:40:06+00:00"},{"url":"https://www.theblockbeats.info/en/news/53822","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.cryptopolitan.com/north-korea-creditors-target-kelp-dao-funds/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829122033/https://www.cryptopolitan.com/north-korea-creditors-target-kelp-dao-funds/","credibility":3,"archive_timestamp":"2026-08-29T12:20:33+00:00"},{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"","type":"other","archive_url":"http://web.archive.org/web/20260729044721/https://www.theblock.co/post/399118/defi-united-detailed-plan","credibility":3,"archive_timestamp":"2026-07-29T04:47:21+00:00"},{"url":"https://www.cryptotimes.io/2026/05/13/kelp-dao-aave-set-to-resume-rseth-operations-after-292m-exploit-recovery/","name":"","type":"other","archive_url":"https://web.archive.org/web/20260829050008/https://www.cryptotimes.io/2026/05/13/kelp-dao-aave-set-to-resume-rseth-operations-after-292m-exploit-recovery/","credibility":3,"archive_timestamp":"2026-08-29T05:00:08+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack","name":"","type":"other","archive_url":"http://web.archive.org/web/20260721044241/https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack","credibility":3,"archive_timestamp":"2026-07-21T04:42:41+00:00"},{"url":"https://www.pymnts.com/cryptocurrency/2026/kelp-dao-293-million-hack-largest-defi-theft-of-2026/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260715003343/https://www.pymnts.com/cryptocurrency/2026/kelp-dao-293-million-hack-largest-defi-theft-of-2026/","credibility":3,"archive_timestamp":"2026-07-15T00:33:43+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:17.099892+00:00","updated_at":"2026-08-30T03:54:58.136985+00:00"}}