{"investigation":{"slug":"kelpdao","entity_name":"KelpDAO","trust_score":0,"severity_base":null,"score_modifier":-5.6,"confidence":0.87,"status":"published","content_type":"investigation","summary":"KelpDAO is a liquid restaking protocol that issues rsETH, launched in late 2023 by the team behind Stader Labs. In April 2026 its LayerZero-based rsETH bridge was exploited for roughly $292 million (116,500 rsETH); LayerZero preliminarily attributed the attack to North Korea's Lazarus Group (TraderTraitor), and TRM Labs also attributes it to a North Korean actor. Kelp and LayerZero publicly dispute responsibility for the bridge configuration, and a DeFi-industry recovery effort (DeFi United) restored rsETH backing within weeks while a legal claim over frozen funds remained unresolved in sources found.","sections":[{"content":"Kelp DAO launched in November 2023 and was founded by Amitej Gajjala and Dheeraj Borra, the same team behind liquid-staking protocol Stader Labs. Its main product is rsETH, a liquid restaking token. In 2024 the project raised a private token round of about $9 million in total, with SCB Limited and Laser Digital (Nomura's crypto unit) leading with a combined $3.5 million; Bankless Ventures, GSR and DWF Ventures also participated, at a reported $90 million fully diluted valuation. Reported TVL figures vary between sources (roughly $1.7 billion to over $2 billion) and no single dated figure was independently confirmed in this research; the earlier claim that rsETH had passed $1 billion TVL and was integrated across 'most major' lending markets could not be verified against a dated credible source and is not asserted here. The 20+ chain figure for wrapped rsETH is consistent with CoinDesk-style reporting of wrapped rsETH 'stranded across 20 chains'.","heading":"Background and Team","sources":[{"url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation","name":"The Block: Kelp token round valuation","type":"news_article","credibility":2},{"url":"https://governance.aave.com/t/arfc-add-rseth-to-aave-v3-ethereum/17696/8","name":"Aave governance: ARFC Add rsETH to Aave V3 Ethereum","type":"community_report","credibility":3}],"severity":"low"},{"content":"Kelp stated in Aave governance posts that it had undergone multiple audits including Sigma Prime and a Code4rena competition. A LlamaRisk assessment on the same forum noted the Code4rena reward pool was only about $28k, low versus industry standards, and flagged that the protocol was relatively centralized with the team having control despite being advertised as non-custodial. These assessments date from 2024; current audit and bug-bounty status was not verified. In April 2025 Aave governance discussed a precautionary freeze of rsETH (a separate earlier event; details not independently reviewed here).","heading":"Security, Audits and Centralization Concerns","sources":[{"url":"https://governance.aave.com/t/arfc-add-rseth-to-aave-v3-ethereum/17696/8","name":"Aave governance: ARFC Add rsETH to Aave V3 Ethereum","type":"community_report","credibility":3},{"url":"https://governance.aave.com/t/rseth-precautionary-freezing-30-04-2025/21925","name":"Aave governance: rsETH precautionary freezing","type":"community_report","credibility":3}],"severity":"medium"},{"content":"On April 18, 2026 an attacker drained about 116,500 rsETH (roughly $292 million, around 18% of circulating supply) from Kelp's LayerZero-powered cross-chain bridge, then used unbacked rsETH as collateral to borrow on Aave. According to LayerZero's post-mortem, attackers compromised RPC nodes relied on by the verifier, fed it falsified chain data and DDoS'd healthy nodes so a forged cross-chain message passed validation. Kelp's pauser multisig froze core contracts about 46 minutes after the drain, blocking two follow-up attempts. Reported loss figures range from about $290 million to $293 million.","heading":"April 2026 Bridge Exploit","sources":[{"url":"https://www.theblock.co/post/397988/kelp-dao-293-million-defi-hack-lazarus-layerzero","name":"The Block: Kelp DAO rsETH bridge exploited","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero says Lazarus likely behind exploit","type":"news_article","credibility":2},{"url":"https://bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers","name":"BleepingComputer: KelpDAO suffers $290 million heist","type":"news_article","credibility":2}],"severity":"critical"},{"content":"LayerZero stated preliminary indicators suggested a highly sophisticated state actor, likely DPRK's Lazarus Group, more specifically TraderTraitor. TRM Labs attributes about $577 million of April 2026 hack losses to North Korean actors: Drift Protocol (about $285 million, April 1) and KelpDAO (about $292 million, April 18), together 76% of 2026 hack value through April. TRM attributes KelpDAO to TraderTraitor and assesses the Drift actor as a separate North Korean subgroup, so the two incidents are not attributed to the same threat actor. North Korea has denied sponsoring crypto theft, calling the allegations politically motivated. Attribution remains an assessment by private firms, not a government finding in the sources found.","heading":"Attribution to North Korea","sources":[{"url":"https://www.theblock.co/post/399569/","name":"The Block: North Korea accounts for 76% of 2026 hack losses (TRM)","type":"news_article","credibility":2},{"url":"https://decrypt.co/366241/north-korean-hackers-stolen-6-billion-crypto-trm","name":"Decrypt: North Korean hackers have stolen $6 billion (TRM)","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero attributes to Lazarus","type":"news_article","credibility":2}],"severity":"high"},{"content":"LayerZero's post-mortem blamed Kelp's 1-of-1 DVN configuration (LayerZero Labs as sole verifier). Kelp rebutted that this was LayerZero's documented default, that LayerZero personnel approved the configuration, and that it was reviewed in eight integration meetings over about two and a half years. LayerZero said Kelp deployed multi-DVN and manually downgraded to 1/1. A Dune analysis found about 47% of roughly 2,665 active LayerZero OApps used 1-of-1 DVNs; researcher Banteg could not prove which configuration Kelp originally deployed. LayerZero later admitted it made a mistake in allowing its DVN to act as 1/1 for high-value transactions, and changed policy (no 1/1 for its DVN, defaults to 5/5 where possible, multisig threshold increase). The dispute was not independently resolved in sources found. Kelp said it would migrate to Chainlink CCIP.","heading":"Responsibility Dispute with LayerZero","sources":[{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Unchained: Kelp claims LayerZero approved the setup, migrates to Chainlink","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/security/layerzero-labs-security-incident-multisig-violation-rjuv1s","name":"The Defiant: LayerZero admits mistake in 1/1 DVN setup","type":"news_article","credibility":2},{"url":"https://decrypt.co/366903/kelp-layerzero-292-million-hack-plans-move-chainlink","name":"Decrypt: Kelp blames LayerZero, plans switch to Chainlink","type":"news_article","credibility":2}],"severity":"high"},{"content":"rsETH markets were frozen on Aave V3 and V4; SparkLend, Fluid and Upshift also paused or froze rsETH. Estimates of Aave bad debt ranged from about $177 million to $236 million (DeFiLlama, per The Defiant) and about $195 million (Lookonchain); no final figure was confirmed. Large Aave withdrawals followed (more than $5.4 billion pulled per Whale Alert, with Forklog reporting more than $8.6 billion). The AAVE token drop is reported differently by timing: roughly 10-13% early (The Block, Whale Alert) and more than 18% about 24 hours later (The Defiant); other outlets reported steeper declines of about 15-20% or more. The number of protocols affected was not confirmed by a source giving an exact count; CoinDesk named Euler, Sentora and Aave among those with notable TVL declines.","heading":"Market Impact and DeFi Contagion","sources":[{"url":"https://thedefiant.io/news/defi/aave-price-crash-kelpdao-exploit-whale-dump-rxi8o9","name":"The Defiant: AAVE price crash after Kelp exploit","type":"news_article","credibility":2},{"url":"https://whale-alert.io/stories/83a801fbc87c53/Exploit-of-KelpDAO-rsETH-minting-inflates-rsETH-deposits-to-Aave-V3-on-Ethereum-Arbitrum-estimated-280M-loss-AAVE-down-1013","name":"Whale Alert: Kelp rsETH bridge exploit triggers mass Aave withdrawals","type":"social_media","credibility":3},{"url":"https://forklog.com/en/news/investors-pull-more-than-8-6bn-from-aave-after-kelp-hack","name":"Forklog: Investors pull more than $8.6bn from Aave","type":"news_article","credibility":2},{"url":"https://www.falconx.io/newsroom/the-kelp-exploit-assessing-positioning-and-the-potential-consequences-for-defi","name":"FalconX: The Kelp Exploit","type":"research","credibility":2}],"severity":"high"},{"content":"A coalition called DeFi United pledged over $300 million (including 30,000 ETH from Consensys and Joe Lubin, 30,000 ETH from Mantle, and contributions from Stani Kulechov, EtherFi, Ethena and LayerZero). Its plan converted committed ETH to rsETH in tranches deposited into the bridge lockbox and liquidated the attacker's Aave and Compound positions using adjusted oracle prices. Kelp later reported sending a final tranche of 20,373.7 rsETH, closing the operational part of the recovery plan, and Aave and Kelp announced resumption of rsETH operations. Kelp reported changing verification to four independent attestors, raising confirmations from 42 to 64, and deprecating L2-to-L2 routes.","heading":"DeFi United Recovery and Bridge Changes","sources":[{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"The Block: DeFi United detailed plan","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/401060/kelp-dao-aave-resume-rseth","name":"The Block: Kelp DAO, Aave to resume rsETH operations","type":"news_article","credibility":2},{"url":"https://decrypt.co/365724/aave-led-defi-united-relief-effort-raises-300m-kelp-dao-losses","name":"Decrypt: Aave-led DeFi United raises $300M","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On April 20, 2026 the Arbitrum Security Council froze 30,766 ETH (about $71 million) the attacker moved on Arbitrum. On May 1, a restraining notice was issued in the U.S. District Court for the Southern District of New York at the request of holders of unpaid terrorism judgments against North Korea (claims over $877 million), naming Arbitrum DAO as garnishee. Arbitrum DAO voted (about 91% in favor) to release the funds to the recovery effort. Aave LLC asked the court to vacate the notice or require a bond of at least $300 million. The court's ultimate ruling was not found in sources reviewed.","heading":"Legal Proceedings Over Frozen Funds","sources":[{"url":"https://www.theblock.co/post/399819/north-korea-terrorism-creditors-move-to-seize-arbitrum-frozen-kelp-dao-eth-ahead-of-defi-united-vote","name":"The Block: North Korea terrorism creditors move to seize frozen ETH","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/400527/arbitrum-dao-approves-eth-release","name":"The Block: Arbitrum DAO approves ETH release","type":"news_article","credibility":2},{"url":"https://forklog.com/en/news/new-york-court-bars-arbitrum-from-unfreezing-30000-stolen-eth","name":"Forklog: New York court bars Arbitrum from unfreezing ETH","type":"news_article","credibility":2}],"severity":"high"},{"content":"No regulatory enforcement action against KelpDAO was found. Address-level on-chain forensics and independent resolution of the LayerZero configuration dispute were not located in credible sources; the most recent coverage found dates from May 2026.","heading":"Regulatory Status and Coverage Gaps","sources":[{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero says Lazarus likely behind exploit","type":"news_article","credibility":2}],"severity":"low"}],"timeline":[{"date":"2023-11","event":"Kelp DAO launches, founded by the Stader Labs team","source":"The Block","source_url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation"},{"date":"2026-04","event":"Attacker drains about 116,500 rsETH (about $292M) from Kelp's LayerZero bridge on April 18; Kelp pauses contracts about 46 minutes later","source":"The Block","source_url":"https://www.theblock.co/post/397988/kelp-dao-293-million-defi-hack-lazarus-layerzero"},{"date":"2026-04","event":"Arbitrum Security Council freezes 30,766 ETH linked to the attacker (April 20); Aave freezes rsETH markets; AAVE token falls","source":"The Block","source_url":"https://www.theblock.co/post/399819/north-korea-terrorism-creditors-move-to-seize-arbitrum-frozen-kelp-dao-eth-ahead-of-defi-united-vote"},{"date":"2026-04","event":"LayerZero preliminarily attributes the attack to Lazarus Group (TraderTraitor); Kelp disputes LayerZero's account of the bridge configuration","source":"The Block","source_url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus"},{"date":"2026-05","event":"SDNY restraining notice on frozen ETH (May 1); Arbitrum DAO votes to release funds to recovery; Kelp announces move to Chainlink CCIP","source":"The Block","source_url":"https://www.theblock.co/post/400527/arbitrum-dao-approves-eth-release"},{"date":"2026-05","event":"Kelp reports final recovery tranche sent and Aave/Kelp move to resume rsETH operations","source":"The Block","source_url":"https://www.theblock.co/post/401060/kelp-dao-aave-resume-rseth"}],"sources_used":[{"url":"https://www.theblock.co/post/397988/kelp-dao-293-million-defi-hack-lazarus-layerzero","name":"The Block: Kelp DAO rsETH bridge exploited","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero says Lazarus likely behind exploit","type":"news_article","archive_url":"http://web.archive.org/web/20260423231523/https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","credibility":2,"archive_timestamp":"2026-04-23T23:15:23+00:00"},{"url":"https://bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers","name":"BleepingComputer: KelpDAO heist","type":"news_article","archive_url":"http://web.archive.org/web/20260906214917/https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/","credibility":2,"archive_timestamp":"2026-09-06T21:49:17+00:00"},{"url":"https://www.theblock.co/post/399569/","name":"The Block: TRM Labs North Korea 76%","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://decrypt.co/366241/north-korean-hackers-stolen-6-billion-crypto-trm","name":"Decrypt: TRM North Korea $6 billion","type":"news_article","archive_url":"http://web.archive.org/web/20260519163910/https://decrypt.co/366241/north-korean-hackers-stolen-6-billion-crypto-trm","credibility":2,"archive_timestamp":"2026-05-19T16:39:10+00:00"},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Unchained: Kelp claims LayerZero approved setup","type":"news_article","archive_url":"http://web.archive.org/web/20261016110808/https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","credibility":2,"archive_timestamp":"2026-10-16T11:08:08+00:00"},{"url":"https://thedefiant.io/news/security/layerzero-labs-security-incident-multisig-violation-rjuv1s","name":"The Defiant: LayerZero admits mistake","type":"news_article","archive_url":"http://web.archive.org/web/20261010190021/https://thedefiant.io/news/security/layerzero-labs-security-incident-multisig-violation-rjuv1s","credibility":2,"archive_timestamp":"2026-10-10T19:00:21+00:00"},{"url":"https://decrypt.co/366903/kelp-layerzero-292-million-hack-plans-move-chainlink","name":"Decrypt: Kelp blames LayerZero","type":"news_article","archive_url":"http://web.archive.org/web/20260930210921/https://decrypt.co/366903/kelp-layerzero-292-million-hack-plans-move-chainlink","credibility":2,"archive_timestamp":"2026-09-30T21:09:21+00:00"},{"url":"https://thedefiant.io/news/defi/aave-price-crash-kelpdao-exploit-whale-dump-rxi8o9","name":"The Defiant: AAVE price crash","type":"news_article","archive_url":"http://web.archive.org/web/20261004102058/https://thedefiant.io/news/defi/aave-price-crash-kelpdao-exploit-whale-dump-rxi8o9","credibility":2,"archive_timestamp":"2026-10-04T10:20:58+00:00"},{"url":"https://whale-alert.io/stories/83a801fbc87c53/Exploit-of-KelpDAO-rsETH-minting-inflates-rsETH-deposits-to-Aave-V3-on-Ethereum-Arbitrum-estimated-280M-loss-AAVE-down-1013","name":"Whale Alert story","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://forklog.com/en/news/investors-pull-more-than-8-6bn-from-aave-after-kelp-hack","name":"Forklog: Aave withdrawals","type":"news_article","archive_url":"https://web.archive.org/web/20261030205822/https://forklog.com/en/cybersecurity-experts-warn-of-new-wave-of-north-korean-hacker-attacks/","credibility":2,"archive_timestamp":"2026-10-30T20:58:22+00:00"},{"url":"https://www.falconx.io/newsroom/the-kelp-exploit-assessing-positioning-and-the-potential-consequences-for-defi","name":"FalconX: The Kelp Exploit","type":"research","archive_url":"http://web.archive.org/web/20260511174023/https://www.falconx.io/newsroom/the-kelp-exploit-assessing-positioning-and-the-potential-consequences-for-defi","credibility":2,"archive_timestamp":"2026-05-11T17:40:23+00:00"},{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"The Block: DeFi United detailed plan","type":"news_article","archive_url":"http://web.archive.org/web/20260729044721/https://www.theblock.co/post/399118/defi-united-detailed-plan","credibility":2,"archive_timestamp":"2026-07-29T04:47:21+00:00"},{"url":"https://www.theblock.co/post/401060/kelp-dao-aave-resume-rseth","name":"The Block: Kelp, Aave resume rsETH","type":"news_article","archive_url":"http://web.archive.org/web/20260516123832/https://www.theblock.co/post/401060/kelp-dao-aave-resume-rseth","credibility":2,"archive_timestamp":"2026-05-16T12:38:32+00:00"},{"url":"https://decrypt.co/365724/aave-led-defi-united-relief-effort-raises-300m-kelp-dao-losses","name":"Decrypt: DeFi United raises $300M","type":"news_article","archive_url":"http://web.archive.org/web/20260521045740/https://decrypt.co/365724/aave-led-defi-united-relief-effort-raises-300m-kelp-dao-losses","credibility":2,"archive_timestamp":"2026-05-21T04:57:40+00:00"},{"url":"https://www.theblock.co/post/399819/north-korea-terrorism-creditors-move-to-seize-arbitrum-frozen-kelp-dao-eth-ahead-of-defi-united-vote","name":"The Block: terrorism creditors and frozen ETH","type":"news_article","archive_url":"http://web.archive.org/web/20260503195232/https://www.theblock.co/post/399819/north-korea-terrorism-creditors-move-to-seize-arbitrum-frozen-kelp-dao-eth-ahead-of-defi-united-vote","credibility":2,"archive_timestamp":"2026-05-03T19:52:32+00:00"},{"url":"https://www.theblock.co/post/400527/arbitrum-dao-approves-eth-release","name":"The Block: Arbitrum DAO approves release","type":"news_article","archive_url":"http://web.archive.org/web/20260509032738/https://www.theblock.co/post/400527/arbitrum-dao-approves-eth-release","credibility":2,"archive_timestamp":"2026-05-09T03:27:38+00:00"},{"url":"https://forklog.com/en/news/new-york-court-bars-arbitrum-from-unfreezing-30000-stolen-eth","name":"Forklog: NY court bars Arbitrum","type":"news_article","archive_url":"https://web.archive.org/web/20261030205832/https://forklog.com/en/arbitrum-council-member-calls-for-usdc-boycott/","credibility":2,"archive_timestamp":"2026-10-30T20:58:32+00:00"},{"url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation","name":"The Block: Kelp token round","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://governance.aave.com/t/arfc-add-rseth-to-aave-v3-ethereum/17696/8","name":"Aave governance: ARFC rsETH","type":"community_report","archive_url":"http://web.archive.org/web/20261028171607/https://governance.aave.com/t/arfc-add-rseth-to-aave-v3-ethereum/17696/8","credibility":3,"archive_timestamp":"2026-10-28T17:16:07+00:00"},{"url":"https://governance.aave.com/t/rseth-precautionary-freezing-30-04-2025/21925","name":"Aave governance: rsETH precautionary freezing","type":"community_report","archive_url":"http://web.archive.org/web/20261004211452/https://governance.aave.com/t/rseth-precautionary-freezing-30-04-2025/21925","credibility":3,"archive_timestamp":"2026-10-04T21:14:52+00:00"}],"source_tags":["zachxbt"],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-05-04T16:05:01.803056+00:00","updated_at":"2026-11-03T23:22:19.099+00:00"},"source_quality":{"total":21,"tier1":0,"tier2":11,"tier3":0,"unrated":10},"follower_count":null,"content_updated_at":"2026-11-03T23:22:19.778Z","last_fact_checked_at":"2026-10-26T22:41:47.062Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}