{"investigation":{"slug":"kelpdao","entity_name":"KelpDAO","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.87,"status":"draft","content_type":"investigation","summary":"KelpDAO is a liquid restaking protocol built on EigenLayer, founded in 2023, that issues rsETH as a yield-bearing liquid restaking token. On April 18, 2026, attackers attributed to North Korea's Lazarus Group (TraderTraitor / UNC4899) exploited a single-point-of-failure DVN configuration on KelpDAO's LayerZero bridge to drain 116,500 rsETH worth approximately $292 million — the largest single DeFi exploit of 2026. The attack triggered $13.21 billion in DeFi TVL outflows within 48 hours and precipitated an industry-wide bailout coalition called DeFi United, which ultimately restored rsETH to full backing by May 25, 2026.","sections":[{"content":"KelpDAO was founded in 2023 by Amitej Gajjala and Dheeraj Borra, who also co-founded Stader Labs. Gajjala's background includes roles as an Assistant Vice President at Swiggy and Zapr Media Labs; Borra previously worked as an engineer at LinkedIn, Blend Labs, and PayPal. The protocol is a liquid restaking platform built on EigenLayer that allows users to deposit staked ETH assets such as stETH or cbETH, which are then delegated to EigenLayer operators. In return, depositors receive rsETH, a yield-bearing liquid restaking token. By April 2026, rsETH had crossed $1 billion in TVL and was integrated as collateral across most major DeFi lending markets, with rsETH-backed wrapped tokens deployed on more than 20 blockchain networks.","heading":"Protocol Background","sources":[{"url":"https://www.kucoin.com/blog/kelpdao-hack-2026-rseth-exploit-analysis","name":"What Is KelpDAO? How Its $292M Hack Shook the Crypto Market in 2026 — KuCoin","type":"news_article","credibility":2},{"url":"https://messari.io/project/kelp-dao","name":"Kelp DAO Price, rsETH to USD, Research, News and Fundraising — Messari","type":"research","credibility":2}],"severity":"low"},{"content":"On April 18, 2026 at 17:35 UTC, attackers drained 116,500 rsETH (approximately $292 million, representing roughly 18% of the token's circulating supply) from KelpDAO's LayerZero-powered cross-chain bridge. This was not a smart contract vulnerability; KelpDAO's on-chain code contained no exploitable bug. Instead, the attack targeted off-chain RPC infrastructure that LayerZero's Decentralized Verifier Network (DVN) used to confirm cross-chain messages.\n\nAccording to LayerZero's May 18, 2026 incident report, the breach began on March 6, 2026, when an attacker socially engineered a LayerZero Labs developer into cloning a malicious GitHub repository. This installed FLATROOF and ROOFDECK malware on a company device, giving attackers remote access and enabling them to harvest session keys for LayerZero's RPC cloud infrastructure. The attackers then poisoned internal RPC nodes with a custom binary that returned accurate responses to LayerZero's monitoring systems while feeding false transaction data to the DVN signing service. On April 18, the attackers simultaneously launched a distributed denial-of-service attack against external RPC providers, forcing the DVN to rely exclusively on the two compromised internal nodes. The poisoned nodes reported that rsETH had been burned on Unichain when no such burn had occurred. The LayerZero Labs DVN, reading only from those nodes, confirmed the fabricated cross-chain message as valid and the Ethereum-side bridge contract released 116,500 rsETH to an attacker-controlled address. KelpDAO's emergency pauser multisig froze the protocol's core contracts 46 minutes after the successful drain, at 18:21 UTC, blocking two subsequent attack attempts that would have cost a further estimated $95 million.","heading":"The April 2026 Exploit: Attack Mechanics","sources":[{"url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","name":"LayerZero Labs KelpDAO Incident Report — LayerZero (official)","type":"official","credibility":1},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero Labs KelpDAO Incident Report PDF — May 18, 2026","type":"official","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"2026's Biggest Crypto Exploit: Kelp DAO Hit for $292 Million — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","credibility":1},{"url":"https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/","name":"LayerZero Details $292M KelpDAO Exploit and Tightens Bridge Security — crypto.news","type":"news_article","credibility":2}],"severity":"critical"},{"content":"LayerZero attributed the attack with preliminary confidence to North Korea's Lazarus Group, specifically the subgroup known as TraderTraitor (also tracked as UNC4899). This attribution was independently corroborated by Mandiant and CrowdStrike. The same threat actor allegedly drained over $575 million from DeFi protocols within an 18-day window across structurally different attack vectors including governance manipulation and infrastructure poisoning. The attackers used the stolen rsETH tokens as collateral on Aave to borrow and drain real ETH, demonstrating familiarity with DeFi lending mechanics consistent with prior Lazarus Group operations.","heading":"Attribution: DPRK Lazarus Group (TraderTraitor)","sources":[{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero Blames Kelp's Setup for $290 Million Exploit, Attributes It to North Korea's Lazarus — CoinDesk","type":"news_article","credibility":1},{"url":"https://cryptobriefing.com/kelpdao-exploit-layers-of-compromise/","name":"LayerZero Says North Korean Lazarus Group Behind $292M Kelp DAO Attack — Crypto Briefing","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/","name":"Lazarus Group Suspected of Moving $175M in ETH After Arbitrum Freezes $71M From KelpDAO Exploit — Bitcoin.com News","type":"news_article","credibility":2}],"severity":"critical"},{"content":"In the immediate aftermath, LayerZero's initial public statement attributed the exploit to KelpDAO's decision to operate a 1-of-1 DVN configuration — meaning LayerZero's own verifier was the sole approver of all cross-chain messages. LayerZero stated that its integration checklist had explicitly recommended a multi-verifier setup requiring consensus across independent DVNs, and that a properly hardened 2-of-2 or higher configuration would have prevented the attack even with a single compromised DVN.\n\nKelpDAO disputed this framing, arguing that LayerZero had approved the configuration and that the root failure was in LayerZero's own infrastructure. KelpDAO's own post-incident statement alleged that LayerZero's defaults and approval process bore responsibility.\n\nLayerZero's May 18 incident report added a significant detail: KelpDAO had originally operated a 2-of-2 DVN configuration and had downgraded it to 1-of-1 before the exploit. On May 9, 2026, LayerZero issued a revised statement acknowledging: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions' and 'We didn't police what our DVN was securing, which created a risk we simply didn't see. We own that.' Following the exploit and the attribution dispute, KelpDAO migrated its bridge infrastructure from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP), which requires multiple independent oracle networks to approve transfers. OpenZeppelin noted in a public analysis that no smart contract bugs were found and classified the incident as an off-chain infrastructure compromise enabled by a single-verifier architecture.","heading":"DVN Configuration Dispute Between KelpDAO and LayerZero","sources":[{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"Kelp DAO Hits Back at LayerZero for Trying to Shift the Blame — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp Says LayerZero Approved Setup It Blamed for $292 Million Bridge Hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero Says It 'Made a Mistake' in $292 Million Kelp Exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://thedefiant.io/news/hacks/layerzero-s-incident-report-says-kelp-downgraded-from-2-of-2-to-1-of-1-before-usd292m-exploit","name":"LayerZero's Incident Report Says Kelp Downgraded From 2-of-2 to 1-of-1 DVN Before $292M Exploit — The Defiant","type":"news_article","credibility":2},{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found: Lessons From the rsETH Bridge Exploit — OpenZeppelin","type":"research","credibility":2},{"url":"https://layerzero.network/blog/kelpdao-incident-statement","name":"LayerZero KelpDAO Incident Statement — LayerZero (official)","type":"official","credibility":1},{"url":"https://cryptopotato.com/after-disputing-layerzero-claims-kelpdao-prepares-chainlink-ccip-migration/","name":"After Disputing LayerZero Claims, KelpDAO Prepares Chainlink CCIP Migration — CryptoPotato","type":"news_article","credibility":2}],"severity":"high"},{"content":"The stolen 116,500 rsETH represented the reserves backing wrapped rsETH across more than 20 blockchain networks, immediately undermining the collateral value of the token on non-Ethereum deployments. Attackers deposited approximately 90,000 of the stolen rsETH into Aave as collateral and borrowed approximately $190 million in ETH and other assets, creating unbacked debt positions across the lending platform.\n\nWithin 48 hours of the exploit, DeFi total value locked (TVL) declined from $99.497 billion to $86.286 billion — a $13.21 billion drop. Aave experienced $8.45 billion in deposit outflows, with its TVL falling to $17.947 billion. At least nine DeFi protocols were directly affected. Aave froze rsETH markets on V3 and V4; SparkLend and Fluid suspended trading; Lido Finance paused deposits into its earnETH product. AAVE token fell approximately 10% in the immediate aftermath. April 2026 became the worst month for crypto hacks in over a year, with DeFi losses for the month surpassing $600 million.","heading":"Cascading DeFi Market Impact","sources":[{"url":"https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack","name":"DeFi TVL Drops More Than $13 Billion in Two Days Following Kelp DAO Hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack","name":"Aave Rallies DeFi Partners to Contain Fallout From $292 Million KelpDAO Hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://finance.yahoo.com/markets/crypto/articles/defi-losses-surpass-600m-kelp-152251247.html","name":"DeFi Losses Surpass $600M as Kelp DAO Exploit Pushes TVL to One-Year Low — Yahoo Finance","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/21/the-usd292-million-kelp-dao-exploit-shows-why-crypto-bridges-are-still-one-of-the-industry-s-weakest-links","name":"The $292 Million Kelp DAO Exploit Shows Why Crypto Bridges Are Still One of the Industry's Weakest Links — CoinDesk","type":"news_article","credibility":1}],"severity":"critical"},{"content":"On April 21, 2026, Arbitrum's Security Council took emergency action to freeze 30,766 ETH (approximately $71 million) connected to the KelpDAO exploit, acting in coordination with law enforcement. The Arbitrum DAO initiated an emergency vote to update the sequencer's filtering parameters, preventing the attacker from bridging the frozen ETH out of the network.\n\nOn May 1, 2026, the U.S. District Court for the Southern District of New York issued a restraining order blocking movement of the frozen assets. The order was obtained by families holding terrorism judgments against North Korea, including plaintiffs Han Kim and Yong Seok Kim, whose relative was killed by Pyongyang. The plaintiffs hold combined claims exceeding $877 million, stemming from a 2015 court ruling awarding over $300 million in damages. Their legal argument invokes the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, which permit creditors to attach assets connected to state sponsors of terrorism. The U.S. court order complicated the DeFi United recovery initiative, as the frozen Arbitrum funds represented the largest single planned contribution to the rsETH replenishment effort.\n\nSeparate from these frozen funds, Lazarus Group–linked addresses were reported to be moving approximately $175 million in ETH through mixing services following the Arbitrum freeze, suggesting a significant portion of stolen assets had already been laundered or converted.","heading":"Arbitrum Security Council Intervention and U.S. Court Order","sources":[{"url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","name":"Arbitrum Freezes $71 Million in Ether Tied to Kelp DAO Exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/","name":"U.S. Court Freezes $71 Million in Kelp DAO ETH After North Korea Terrorism Creditors File Claim — Unchained","type":"court_filing","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/22/inside-the-usd71-million-freeze-on-arbitrum-that-has-the-crypto-world-questioning-what-decentralization-really-means","name":"Inside the $71 Million Freeze on Arbitrum That Has the Crypto World Questioning What Decentralization Really Means — CoinDesk","type":"news_article","credibility":1},{"url":"https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/","name":"Lazarus Group Suspected of Moving $175M in ETH After Arbitrum Freezes $71M — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://www.mexc.com/news/1069056","name":"Court Blocks Arbitrum DAO from Releasing $71 Million in Hacked Ethereum — MEXC News","type":"news_article","credibility":2}],"severity":"high"},{"content":"Aave founder Stani Kulechov coordinated a multi-protocol bailout initiative called DeFi United, assembling pledges from major DeFi ecosystem participants to restore rsETH's full backing and prevent broader contagion. Key contributors included Consensys and founder Joe Lubin (30,000 ETH commitment), Mantle (30,000 ETH), a pending 25,000 ETH Aave DAO treasury proposal, EtherFi (5,000 ETH), Stani Kulechov personally (5,000 ETH), Lido Finance (up to 2,500 stETH), and KelpDAO itself (2,000 ETH from its treasury). As of late April 2026, DeFi United had assembled approximately $302.26 million in pledges (132,706 ETH), though some contributions remained contingent on DAO votes.\n\nThe recovery strategy involved staged deposits of pledged ETH into KelpDAO's bridge adapter contracts, converting committed ETH into rsETH tranches to restore the token's full backing at the prevailing exchange ratio of 1.07 ETH per rsETH. On May 25, 2026, KelpDAO and Aave jointly announced that rsETH recovery had been completed, with a final tranche of 20,373.72 rsETH transferred into the protocol's OFT adapter. KelpDAO's live rsETH dashboard subsequently showed a 100.01% ETH backing ratio. Minting, redemption, and reward operations were restored to full functionality.","heading":"DeFi United Bailout and rsETH Recovery","sources":[{"url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack","name":"Aave Rallies DeFi Partners to Contain Fallout From $292 Million KelpDAO Hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack","name":"Who's Pledging to Aave's $300 Million DeFi Recovery Effort After Massive Kelp DAO Exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"DeFi United Unveils Plan to Restore rsETH After $292 Million Kelp DAO Exploit — The Block","type":"news_article","credibility":1},{"url":"https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack","name":"Kelp DAO Says rsETH Fully Restored 5 Weeks After Hack — CoinTelegraph","type":"news_article","credibility":2},{"url":"https://ambcrypto.com/kelpdao-says-rseth-recovery-completed-as-backing-returns-above-100/","name":"KelpDAO Says rsETH Recovery Completed as Backing Returns Above 100% — AMBCrypto","type":"news_article","credibility":2},{"url":"https://crypto.news/kelpdao-commits-2000-eth-to-defi-united-recovery-fund-for-rseth-restoration/","name":"KelpDAO Commits 2,000 ETH to DeFi United Recovery Fund — crypto.news","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The KelpDAO exploit accelerated an industry-wide migration away from LayerZero toward alternative bridge architectures. KelpDAO migrated rsETH to Chainlink's Cross-Chain Interoperability Protocol (CCIP), Solv Protocol moved over $700 million in tokenized bitcoin infrastructure off LayerZero, and Kraken announced it would replace LayerZero with Chainlink for kBTC and future wrapped assets. Over $3 billion in DeFi assets were reported to have migrated to Chainlink CCIP in the aftermath. LayerZero implemented a policy change requiring that its DVN refuse to sign as the sole required attestor on any channel, enforcing a baseline multi-verifier configuration going forward. Brale publicly disclosed its own actions to contain its LayerZero DVN exposure following the incident. The exploit reignited long-running debates in the DeFi community about bridge security models, the adequacy of single-operator verification, and the responsibilities of infrastructure providers to enforce security floors on downstream integrators.","heading":"Broader Industry Fallout and Bridge Security Debate","sources":[{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Kelp DAO Claims LayerZero Approved the Setup It Blamed for $292 Million Hack, Migrates to Chainlink — Unchained","type":"news_article","credibility":1},{"url":"https://news.bitcoin.com/solv-protocol-and-re-switch-to-chainlink-ccip-moving-nearly-1b-away-from-layerzero/","name":"Solv Protocol and Re Switch to Chainlink CCIP, Moving Nearly $1B Away From LayerZero — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/05/14/kraken-to-replace-layerzero-with-chainlink-to-bridge-assets-across-blockchains","name":"Kraken to Replace LayerZero with Chainlink for kBTC, Future Wrapped Assets — CoinDesk","type":"news_article","credibility":1},{"url":"https://brale.xyz/blog/containing-our-layerzero-dvn-in-response-to-the-kelpdao-incident","name":"Containing Our LayerZero DVN in Response to KelpDAO — Brale","type":"official","credibility":2},{"url":"https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up","name":"The $293 Million KelpDAO Hack Shows Why DeFi Is Finally Being Forced to Grow Up — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/business/2026/04/26/why-defi-isn-t-dead-despite-massive-exploits-and-usd13-billion-investor-exodus","name":"Why DeFi Is Not Dead After the KelpDAO Exploit — CoinDesk","type":"news_article","credibility":1}],"severity":"high"}],"timeline":[{"date":"2023","event":"KelpDAO founded by Amitej Gajjala and Dheeraj Borra (also co-founders of Stader Labs); protocol launches rsETH as a liquid restaking token on EigenLayer.","source":"KuCoin blog — KelpDAO background","source_url":"https://www.kucoin.com/blog/kelpdao-hack-2026-rseth-exploit-analysis","date_original":"2023-01-01"},{"date":"2026-03-06","event":"A LayerZero Labs developer is socially engineered into cloning a malicious GitHub repository, installing FLATROOF and ROOFDECK malware on a company device. Attackers harvest session keys for LayerZero's RPC cloud infrastructure and begin poisoning internal RPC nodes — the start of the preparation phase for the exploit.","source":"LayerZero Labs KelpDAO Incident Report — LayerZero (official)","source_url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report"},{"date":"2026-04-18","event":"At 17:35 UTC, attackers execute the exploit. Poisoned RPC nodes feed false burn data to LayerZero's 1-of-1 DVN; the DVN confirms a fabricated cross-chain message and KelpDAO's bridge releases 116,500 rsETH (~$292 million) to attacker-controlled addresses. Attackers deposit ~90,000 stolen rsETH into Aave as collateral and borrow ~$190 million in ETH and other assets.","source":"CoinDesk — 2026's Biggest Crypto Exploit","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04-18","event":"At 18:21 UTC, KelpDAO's emergency pauser multisig freezes the protocol's core contracts 46 minutes after the drain, blocking two subsequent attack attempts estimated at a further $95 million.","source":"CoinDesk — 2026's Biggest Crypto Exploit","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04-19","event":"Aave freezes rsETH markets on V3 and V4. SparkLend and Fluid suspend trading. Lido Finance pauses earnETH deposits. AAVE token falls approximately 10%.","source":"CoinDesk — $292 Million Kelp DAO Exploit","source_url":"https://www.coindesk.com/tech/2026/04/21/the-usd292-million-kelp-dao-exploit-shows-why-crypto-bridges-are-still-one-of-the-industry-s-weakest-links"},{"date":"2026-04-20","event":"LayerZero publicly attributes the attack with preliminary confidence to North Korea's Lazarus Group (TraderTraitor / UNC4899) and blames KelpDAO's 1-of-1 DVN configuration. KelpDAO disputes the framing, arguing LayerZero approved the setup and bears responsibility for its own infrastructure failures.","source":"CoinDesk — LayerZero Blames Kelp's Setup","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-04-20","event":"DeFi TVL drops $13.21 billion in 48 hours, from $99.497 billion to $86.286 billion. Aave alone loses $8.45 billion in deposits. At least nine DeFi protocols are directly affected.","source":"CoinDesk — DeFi TVL Drops More Than $13 Billion","source_url":"https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack"},{"date":"2026-04-21","event":"Arbitrum Security Council freezes 30,766 ETH (~$71 million) linked to the KelpDAO exploit in coordination with law enforcement. An Arbitrum DAO emergency vote updates sequencer filtering to prevent the funds from being bridged out.","source":"CoinDesk — Arbitrum Freezes $71 Million in Ether","source_url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit"},{"date":"2026-04-23","event":"Aave founder Stani Kulechov launches the DeFi United coalition to restore rsETH backing and prevent broader contagion.","source":"CoinDesk — Aave Rallies DeFi Partners","source_url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack"},{"date":"2026-04-27","event":"DeFi United discloses over $300 million in pledges (132,706 ETH) from ecosystem participants including Consensys (30,000 ETH), Mantle (30,000 ETH), Aave DAO (25,000 ETH pending), EtherFi (5,000 ETH), Stani Kulechov (5,000 ETH), Lido (2,500 stETH), and KelpDAO itself (2,000 ETH).","source":"CoinDesk — Who's Pledging to Aave's $300 Million DeFi Recovery Effort","source_url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack"},{"date":"2026-05","event":"The U.S. District Court for the Southern District of New York issues a restraining order blocking Arbitrum DAO from releasing or moving the frozen 30,766 ETH. North Korea terrorism judgment creditors (Han Kim, Yong Seok Kim) invoked the Foreign Sovereign Immunities Act and Terrorism Risk Insurance Act.","source":"Unchained — U.S. Court Freezes $71 Million in Kelp DAO ETH","source_url":"https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/","date_original":"2026-05-01"},{"date":"2026-05-05","event":"KelpDAO formally claims that LayerZero approved the 1-of-1 DVN configuration that enabled the exploit and announces migration of rsETH bridge infrastructure to Chainlink CCIP.","source":"CoinDesk — Kelp Says LayerZero Approved Setup","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05-09","event":"LayerZero issues a revised public statement acknowledging: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions' and accepting shared responsibility for the exploit.","source":"CoinDesk — LayerZero Says It 'Made a Mistake'","source_url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"date":"2026-05-18","event":"LayerZero publishes its full incident report, confirming the March 6 social engineering breach, the FLATROOF/ROOFDECK malware installation, and the detail that KelpDAO had downgraded from a 2-of-2 to a 1-of-1 DVN configuration prior to the exploit. Mandiant and CrowdStrike corroborate DPRK TraderTraitor attribution.","source":"LayerZero Labs KelpDAO Incident Report PDF — LayerZero (official)","source_url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"},{"date":"2026-05-25","event":"KelpDAO and Aave jointly announce completion of the rsETH recovery phase. KelpDAO transfers a final tranche of 20,373.72 rsETH into the OFT adapter, restoring rsETH backing above 100% (dashboard shows 100.01%). Full minting, redemption, and reward operations resume.","source":"CoinTelegraph — Kelp DAO Says rsETH Fully Restored 5 Weeks After Hack","source_url":"https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack"}],"sources_used":[{"url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","name":"LayerZero Labs KelpDAO Incident Report — LayerZero (official blog)","type":"official","archive_url":"http://web.archive.org/web/20260520132621/https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","credibility":1,"archive_timestamp":"2026-05-20T13:26:21+00:00"},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero Labs KelpDAO Incident Report PDF — May 18, 2026","type":"official","archive_url":"http://web.archive.org/web/20260520132632/https://layerzero.network/publications/kelpdao-incident-report.pdf","credibility":1,"archive_timestamp":"2026-05-20T13:26:32+00:00"},{"url":"https://layerzero.network/blog/kelpdao-incident-statement","name":"LayerZero KelpDAO Incident Statement — LayerZero (official)","type":"official","archive_url":"http://web.archive.org/web/20260513163452/https://layerzero.network/blog/kelpdao-incident-statement","credibility":1,"archive_timestamp":"2026-05-13T16:34:52+00:00"},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260526034250/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":1,"archive_timestamp":"2026-05-26T03:42:50+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"2026's Biggest Crypto Exploit: Kelp DAO Hit for $292 Million With Wrapped Ether Stranded Across 20 Chains — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260717072332/https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","credibility":1,"archive_timestamp":"2026-07-17T07:23:32+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero Blames Kelp's Setup for $290 Million Exploit, Attributes It to North Korea's Lazarus — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260526220018/https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","credibility":1,"archive_timestamp":"2026-05-26T22:00:18+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"Kelp DAO Hits Back at LayerZero for Trying to Shift the Blame — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260619205713/https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","credibility":1,"archive_timestamp":"2026-06-19T20:57:13+00:00"},{"url":"https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack","name":"DeFi TVL Drops More Than $13 Billion in Two Days Following Kelp DAO Hack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260608185400/https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack","credibility":1,"archive_timestamp":"2026-06-08T18:54:00+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/21/the-usd292-million-kelp-dao-exploit-shows-why-crypto-bridges-are-still-one-of-the-industry-s-weakest-links","name":"The $292 Million Kelp DAO Exploit Shows Why Crypto Bridges Are Still One of the Industry's Weakest Links — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260423080226/https://www.coindesk.com/tech/2026/04/21/the-usd292-million-kelp-dao-exploit-shows-why-crypto-bridges-are-still-one-of-the-industry-s-weakest-links","credibility":1,"archive_timestamp":"2026-04-23T08:02:26+00:00"},{"url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","name":"Arbitrum Freezes $71 Million in Ether Tied to Kelp DAO Exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260422180712/https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","credibility":1,"archive_timestamp":"2026-04-22T18:07:12+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/22/inside-the-usd71-million-freeze-on-arbitrum-that-has-the-crypto-world-questioning-what-decentralization-really-means","name":"Inside the $71 Million Freeze on Arbitrum — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260424122910/https://www.coindesk.com/tech/2026/04/22/inside-the-usd71-million-freeze-on-arbitrum-that-has-the-crypto-world-questioning-what-decentralization-really-means","credibility":1,"archive_timestamp":"2026-04-24T12:29:10+00:00"},{"url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack","name":"Aave Rallies DeFi Partners to Contain Fallout From $292 Million KelpDAO Hack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260427135700/https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack","credibility":1,"archive_timestamp":"2026-04-27T13:57:00+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack","name":"Who's Pledging to Aave's $300 Million DeFi Recovery Effort — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260721044241/https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack","credibility":1,"archive_timestamp":"2026-07-21T04:42:41+00:00"},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp Says LayerZero Approved Setup It Blamed for $292 Million Bridge Hack — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260508165632/https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","credibility":1,"archive_timestamp":"2026-05-08T16:56:32+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero Says It 'Made a Mistake' in $292 Million Kelp Exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260513193920/https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","credibility":1,"archive_timestamp":"2026-05-13T19:39:20+00:00"},{"url":"https://www.coindesk.com/business/2026/04/26/why-defi-isn-t-dead-despite-massive-exploits-and-usd13-billion-investor-exodus","name":"Why DeFi Is Not Dead After the KelpDAO Exploit — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260510145256/https://www.coindesk.com/business/2026/04/26/why-defi-isn-t-dead-despite-massive-exploits-and-usd13-billion-investor-exodus","credibility":1,"archive_timestamp":"2026-05-10T14:52:56+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up","name":"The $293 Million KelpDAO Hack Shows Why DeFi Is Finally Being Forced to Grow Up — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260526034615/https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up","credibility":1,"archive_timestamp":"2026-05-26T03:46:15+00:00"},{"url":"https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/","name":"U.S. Court Freezes $71 Million in Kelp DAO ETH After North Korea Terrorism Creditors File Claim — Unchained","type":"court_filing","archive_url":"https://web.archive.org/web/20260725040114/https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/","credibility":1,"archive_timestamp":"2026-07-25T04:01:14+00:00"},{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"DeFi United Unveils Plan to Restore rsETH After $292 Million Kelp DAO Exploit — The Block","type":"news_article","archive_url":"http://web.archive.org/web/20260618023307/https://www.theblock.co/post/399118/defi-united-detailed-plan","credibility":1,"archive_timestamp":"2026-06-18T02:33:07+00:00"},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Kelp DAO Claims LayerZero Approved the Setup It Blamed for $292 Million Hack, Migrates to Chainlink — Unchained","type":"news_article","archive_url":"http://web.archive.org/web/20260509090304/https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","credibility":1,"archive_timestamp":"2026-05-09T09:03:04+00:00"},{"url":"https://www.coindesk.com/business/2026/05/14/kraken-to-replace-layerzero-with-chainlink-to-bridge-assets-across-blockchains","name":"Kraken to Replace LayerZero with Chainlink for kBTC, Future Wrapped Assets — CoinDesk","type":"news_article","archive_url":"https://web.archive.org/web/20260724213623/https://www.coindesk.com/business/2026/05/14/kraken-to-replace-layerzero-with-chainlink-to-bridge-assets-across-blockchains","credibility":1,"archive_timestamp":"2026-07-24T21:36:23+00:00"},{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found: Lessons From the rsETH Bridge Exploit — OpenZeppelin","type":"research","archive_url":"http://web.archive.org/web/20260513072415/https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","credibility":2,"archive_timestamp":"2026-05-13T07:24:15+00:00"},{"url":"https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/","name":"LayerZero Details $292M KelpDAO Exploit and Tightens Bridge Security — crypto.news","type":"news_article","archive_url":"https://web.archive.org/web/20260724175454/https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/","credibility":2,"archive_timestamp":"2026-07-24T17:54:54+00:00"},{"url":"https://cryptobriefing.com/kelpdao-exploit-layers-of-compromise/","name":"LayerZero Says North Korean Lazarus Group Behind $292M Kelp DAO Attack — Crypto Briefing","type":"news_article","archive_url":"http://web.archive.org/web/20260423084927/https://cryptobriefing.com/kelpdao-exploit-layers-of-compromise/","credibility":2,"archive_timestamp":"2026-04-23T08:49:27+00:00"},{"url":"https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack","name":"Kelp DAO Says rsETH Fully Restored 5 Weeks After Hack — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260625084613/https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack","credibility":2,"archive_timestamp":"2026-06-25T08:46:13+00:00"},{"url":"https://ambcrypto.com/kelpdao-says-rseth-recovery-completed-as-backing-returns-above-100/","name":"KelpDAO Says rsETH Recovery Completed as Backing Returns Above 100% — AMBCrypto","type":"news_article","archive_url":"http://web.archive.org/web/20260526055609/https://ambcrypto.com/kelpdao-says-rseth-recovery-completed-as-backing-returns-above-100/","credibility":2,"archive_timestamp":"2026-05-26T05:56:09+00:00"},{"url":"https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/","name":"Lazarus Group Suspected of Moving $175M in ETH After Arbitrum Freezes $71M — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260621164245/https://news.bitcoin.com/lazarus-group-suspected-of-moving-175m-in-eth-after-arbitrum-freezes-71m-from-kelpdao-exploit/","credibility":2,"archive_timestamp":"2026-06-21T16:42:45+00:00"},{"url":"https://thedefiant.io/news/hacks/layerzero-s-incident-report-says-kelp-downgraded-from-2-of-2-to-1-of-1-before-usd292m-exploit","name":"LayerZero's Incident Report Says Kelp Downgraded From 2-of-2 to 1-of-1 DVN Before $292M Exploit — The Defiant","type":"news_article","archive_url":"http://web.archive.org/web/20260524134121/https://thedefiant.io/news/hacks/layerzero-s-incident-report-says-kelp-downgraded-from-2-of-2-to-1-of-1-before-usd292m-exploit","credibility":2,"archive_timestamp":"2026-05-24T13:41:21+00:00"},{"url":"https://beincrypto.com/arbitrum-freezes-eth-kelpdao-exploit/","name":"Arbitrum Freezes 30,766 ETH Tied to KelpDAO Hack — BeInCrypto","type":"news_article","archive_url":"https://web.archive.org/web/20260725084629/https://beincrypto.com/arbitrum-freezes-eth-kelpdao-exploit/","credibility":2,"archive_timestamp":"2026-07-25T08:46:29+00:00"},{"url":"https://finance.yahoo.com/markets/crypto/articles/defi-losses-surpass-600m-kelp-152251247.html","name":"DeFi Losses Surpass $600M as Kelp DAO Exploit Pushes TVL to One-Year Low — Yahoo Finance / DeFi Llama","type":"news_article","archive_url":"http://web.archive.org/web/20260426100904/https://finance.yahoo.com/markets/crypto/articles/defi-losses-surpass-600m-kelp-152251247.html","credibility":2,"archive_timestamp":"2026-04-26T10:09:04+00:00"},{"url":"https://crypto.news/kelpdao-commits-2000-eth-to-defi-united-recovery-fund-for-rseth-restoration/","name":"KelpDAO Commits 2,000 ETH to DeFi United Recovery Fund — crypto.news","type":"news_article","archive_url":"https://web.archive.org/web/20260724175342/https://crypto.news/kelpdao-commits-2000-eth-to-defi-united-recovery-fund-for-rseth-restoration/","credibility":2,"archive_timestamp":"2026-07-24T17:53:42+00:00"},{"url":"https://brale.xyz/blog/containing-our-layerzero-dvn-in-response-to-the-kelpdao-incident","name":"Containing Our LayerZero DVN in Response to KelpDAO — Brale","type":"official","archive_url":"https://web.archive.org/web/20260724174654/https://brale.xyz/blog/containing-our-layerzero-dvn-in-response-to-the-kelpdao-incident","credibility":2,"archive_timestamp":"2026-07-24T17:46:54+00:00"},{"url":"https://news.bitcoin.com/solv-protocol-and-re-switch-to-chainlink-ccip-moving-nearly-1b-away-from-layerzero/","name":"Solv Protocol and Re Switch to Chainlink CCIP, Moving Nearly $1B Away From LayerZero — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260530230859/https://news.bitcoin.com/solv-protocol-and-re-switch-to-chainlink-ccip-moving-nearly-1b-away-from-layerzero/","credibility":2,"archive_timestamp":"2026-05-30T23:08:59+00:00"},{"url":"https://www.kucoin.com/blog/kelpdao-hack-2026-rseth-exploit-analysis","name":"What Is KelpDAO? How Its $292M Hack Shook the Crypto Market in 2026 — KuCoin","type":"news_article","archive_url":"https://web.archive.org/web/20260725041417/https://www.kucoin.com/blog/kelpdao-hack-2026-rseth-exploit-analysis","credibility":2,"archive_timestamp":"2026-07-25T04:14:17+00:00"},{"url":"https://messari.io/project/kelp-dao","name":"Kelp DAO Price, rsETH to USD, Research, News and Fundraising — Messari","type":"research","archive_url":"http://web.archive.org/web/20250909164531/https://messari.io/project/kelp-dao","credibility":2,"archive_timestamp":"2025-09-09T16:45:31+00:00"}],"source_tags":["zachxbt"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T16:05:01.803056+00:00","updated_at":"2026-07-25T09:02:23.27621+00:00"}}