{"investigation":{"slug":"kelpdao-bridge-exploit-april-2026","entity_name":"KelpDAO Bridge Exploit (April 2026)","trust_score":18,"severity_base":null,"score_modifier":-8,"confidence":0.88,"status":"draft","content_type":"investigation","summary":"On April 18, 2026, approximately 116,500 rsETH tokens (valued at roughly $292 million) were fraudulently released from KelpDAO's LayerZero V2 bridge adapter via a forged cross-chain message — the largest single DeFi exploit of 2026. Security firms Mandiant, CrowdStrike, and Chainalysis, as well as LayerZero Labs, attributed the attack with high confidence to TraderTraitor (UNC4899), a North Korean state-linked threat actor operating under the Lazarus Group umbrella. The incident exposed systemic risk in off-chain verification infrastructure and triggered a protracted public dispute between KelpDAO and LayerZero over who bore responsibility for the single-verifier configuration that made the attack possible; LayerZero subsequently acknowledged it had made a mistake.","sections":[{"content":"At approximately 17:35 UTC on April 18, 2026, an attacker submitted a forged LayerZero cross-chain message claiming that 116,500 rsETH had been burned on the source chain (Unichain). No such burn transaction existed. KelpDAO's bridge escrow on Ethereum accepted the forged attestation and released 116,500 rsETH — approximately 18% of the token's circulating supply and 74.3% of the total bridge escrow balance — to the attacker's address. The drain was completed within approximately 46–80 minutes before detection and emergency intervention halted further outflows. The total loss was approximately $291–$292 million at prevailing market prices, making it the largest single DeFi exploit recorded in 2026, according to reporting by Bloomberg, CoinDesk, and Chainalysis.","heading":"Incident Overview","sources":[{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.hypernative.io/insights/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed","name":"The KelpDAO Observation-Layer Exploit — Hypernative","type":"research","credibility":2},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","credibility":1}],"severity":"critical"},{"content":"According to LayerZero's incident report and independent analysis by OpenZeppelin, Hypernative, and security firm DEV Community, the attack unfolded in three stages. First, beginning on or around March 6, 2026, a LayerZero Labs developer was socially engineered into cloning a malicious GitHub repository, which installed malware on their macOS system. This malware harvested session keys and allowed the attacker to pivot into LayerZero's RPC cloud environment and compromise at least two RPC nodes that fed transaction data to the LayerZero Labs Decentralized Verifier Network (DVN). The malware was designed to return correct responses to LayerZero's own monitoring tooling while simultaneously serving tampered data to the DVN's validation pipeline — a technique designed to evade detection. Second, the attacker executed a DDoS attack against healthy, uncompromised RPC endpoints, forcing the DVN's verification logic to fall back exclusively onto the poisoned nodes. Third, with full control over the data the sole required DVN received, the attacker injected a synthetic PacketSent event on Unichain, triggering the Ethereum escrow to release 116,500 rsETH against a burn that never occurred. Hypernative's analysis confirmed that the total drained amount exceeded the entire Unichain rsETH supply at the time by a factor of approximately 2,300. All on-chain signatures, message formats, and smart contract calls appeared legitimate; the vulnerability existed entirely in the off-chain verification layer, not in the bridge smart contracts themselves. OpenZeppelin noted that standard smart contract audits typically exclude third-party integration configuration and infrastructure single points of failure, which is why the flaw was not caught in prior security reviews.","heading":"Attack Method and Technical Details","sources":[{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero Labs KelpDAO Incident Report (PDF) — LayerZero","type":"official","credibility":1},{"url":"https://www.hypernative.io/insights/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed","name":"The KelpDAO Observation-Layer Exploit — Hypernative","type":"research","credibility":2},{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found: Lessons From the rsETH Bridge Exploit — OpenZeppelin","type":"research","credibility":2},{"url":"https://dev.to/denniskim/kelpdao-layerzero-bridge-hack-a-sophisticated-attack-on-the-single-point-of-failure-in-off-chain-4m2n","name":"KelpDAO LayerZero Bridge Hack Technical Analysis — DEV Community","type":"research","credibility":2}],"severity":"critical"},{"content":"LayerZero Labs, Mandiant, CrowdStrike, Elliptic, and Chainalysis jointly attributed the attack with high confidence to TraderTraitor (also tracked as UNC4899), a DPRK-aligned threat actor assessed to be part of North Korea's Reconnaissance General Bureau and a subgroup of the broader Lazarus Group. TraderTraitor was previously linked to the Axie Infinity Ronin Bridge exploit (2022) and the WazirX compromise (2024). Attribution evidence cited in public reporting includes the social engineering methodology (malicious GitHub repository targeting developers), the RPC memory-patching technique, pre-funding of the attacker wallet via Tornado Cash approximately eight hours before execution, and on-chain fund movement patterns consistent with prior Lazarus Group operations. As of the writing of this investigation, no criminal charges or government designations directly naming individuals responsible for this specific incident have been publicly reported. The attribution remains the assessment of private security firms and LayerZero, not an adjudicated finding.","heading":"Attribution: North Korea's TraderTraitor Unit","sources":[{"url":"https://decrypt.co/364872/layerzero-pins-292m-kelpdao-bridge-hack-on-north-koreas-lazarus-group","name":"LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group — Decrypt","type":"news_article","credibility":2},{"url":"https://www.crowdfundinsider.com/2026/04/275261-kelpdao-bridge-exploit-analysis-north-korean-hackers-steal-292-million-via-off-chain-attack/","name":"KelpDAO Bridge Exploit Analysis: North Korean Hackers Steal $292 Million — Crowdfund Insider","type":"news_article","credibility":2},{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","credibility":1},{"url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","name":"LayerZero Labs KelpDAO Incident Report — LayerZero","type":"official","credibility":1}],"severity":"critical"},{"content":"Following the unauthorized release of 116,500 rsETH, the attacker deposited approximately 89,567 rsETH into Aave V3 as collateral and immediately borrowed approximately $190–$236 million in WETH across multiple Aave deployments before markets could reprice the unbacked tokens or freeze the relevant pools. This created an estimated $123–$230 million in bad debt for Aave V3, with WETH pools across five chains reaching 100% utilization. Aave V3 froze all rsETH and wrsETH reserves, set loan-to-value ratios to zero, and adjusted interest rate models as emergency measures. Reporting from CoinDesk and The Block documented that the resulting DeFi contagion triggered more than $10 billion in aggregate deposit withdrawals from Aave and related protocols as users rushed to exit exposure. The attacker's wallet had received 0.1 ETH via Tornado Cash approximately eight hours before the exploit — consistent with pre-funding patterns observed in prior DPRK-attributed operations.","heading":"On-Chain Fund Movements and DeFi Contagion","sources":[{"url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos","name":"Aave could face up to $230m in losses after Kelp DAO bridge exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.hypernative.io/insights/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed","name":"The KelpDAO Observation-Layer Exploit — Hypernative","type":"research","credibility":2},{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found — OpenZeppelin","type":"research","credibility":2}],"severity":"critical"},{"content":"The incident triggered a sustained public dispute between KelpDAO and LayerZero Labs over who bore responsibility for the single-verifier (1-of-1 DVN) configuration that created the exploitable single point of failure. LayerZero's initial post-exploit statement blamed KelpDAO, asserting the protocol had ignored repeated recommendations to adopt a multi-verifier setup, and that Kelp had specifically downgraded from a 2-of-2 DVN configuration to a 1-of-1 configuration prior to the attack. KelpDAO disputed this account. In a detailed memo published on or around May 5, 2026, KelpDAO asserted that LayerZero personnel had directly approved the single-verifier configuration across approximately eight integration meetings spanning roughly two and a half years, and that LayerZero's own V2 OApp Quickstart documentation listed single-DVN setups without flagging them as insecure for high-value deployments. KelpDAO also argued that the compromised DVN was part of LayerZero's own infrastructure, not a third-party verifier KelpDAO had independently selected. Independent security researcher Artem K (a Yearn Finance developer) reviewed LayerZero's deployment code and stated that the V2 OApp Quickstart shipped with single-source verification defaults across multiple networks, supporting KelpDAO's characterization. Chainlink manager Zach Rynes publicly accused LayerZero of deflecting responsibility for its compromised infrastructure. Approximately 47% of 2,665 active LayerZero OApp contracts used a 1-of-1 DVN setup within 90 days of the incident, representing roughly $4.5 billion in ecosystem exposure, according to data cited by Unchained Crypto. On approximately May 9, 2026, LayerZero reversed course and issued a public admission. The company stated: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions. We didn't police what our DVN was securing, which created a risk we simply didn't see. We own that.' LayerZero subsequently announced that its DVN would no longer service 1-of-1 configurations and that all defaults were being migrated to a minimum of 3-of-3 and up to 5-of-5 where possible. No court ruling or arbitration finding on the merits of the competing liability claims has been publicly reported as of September 2026.","heading":"Responsibility Dispute: KelpDAO vs. LayerZero","sources":[{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp says LayerZero approved setup it blamed for $292 million bridge hack — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero says it 'made a mistake' in $292 Million Kelp exploit — CoinDesk","type":"news_article","credibility":1},{"url":"https://unchainedcrypto.com/kelp-dao-disputes-layerzeros-account-of-the-290-million-exploit-escalating-blame-game/","name":"Kelp DAO Disputes LayerZero's Account — Unchained Crypto","type":"news_article","credibility":2},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Kelp DAO Claims LayerZero Approved the Setup, Migrates to Chainlink — Unchained Crypto","type":"news_article","credibility":2},{"url":"https://www.crowdfundinsider.com/2026/05/278326-layerzero-apologizes-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup/","name":"LayerZero Apologizes, Admits Fault in Single-Verifier Setup — Crowdfund Insider","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"Kelp DAO hits back at LayerZero — CoinDesk","type":"news_article","credibility":1},{"url":"https://layerzero.network/blog/an-overdue-apology","name":"LayerZero Update / Overdue Apology — LayerZero Official Blog","type":"official","credibility":1}],"severity":"high"},{"content":"On approximately April 23, 2026, Aave rallied a coalition of DeFi protocols — subsequently named DeFi United — to mount a coordinated recovery effort. Participating organizations included Aave DAO, Mantle, Lido DAO, EtherFi, and LayerZero. The coalition aimed to raise sufficient ETH to restore rsETH's backing ratio and cover Aave's bad debt, with reported contributions including 25,000 ETH from the Aave DAO, a 30,000 ETH loan from Mantle, and personal contributions from individuals including Aave founder Stani Kulechov. Reporting from KuCoin and The Block indicated that DeFi United raised over $160 million to $300 million in ETH across tranches. Recovery proceeded via staged deposits of ETH converted to rsETH and injected into the bridge's lockbox contract to restore full collateralization at the prevailing exchange rate of approximately 1.07 ETH per rsETH. On May 25, 2026, KelpDAO and Aave jointly announced that rsETH operations had been fully restored. The final tranche of 20,373.7 rsETH was transferred to the LayerZero lockbox contract, completing the recovery approximately five weeks after the exploit. Aave confirmed all markets and rsETH operations subsequently returned to normal functioning.","heading":"Recovery Effort: DeFi United Coalition","sources":[{"url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack","name":"Aave Rallies DeFi Partners to Contain Fallout — CoinDesk","type":"news_article","credibility":1},{"url":"https://www.kucoin.com/news/flash/defi-united-raises-160m-to-cover-aave-bad-debt-from-kelpdao-exploit","name":"DeFi United Raises $160M to Cover Aave Bad Debt — KuCoin","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"DeFi United Unveils Plan to Restore rsETH — The Block","type":"news_article","credibility":1},{"url":"https://ground.news/article/kelp-dao-completes-rseth-recovery-plan-after-292-million-exploit","name":"Kelp DAO Says rsETH Fully Restored 5 Weeks After Hack — Ground News","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/05/26/aave-and-kelp-dao-restore-rseth-operations-after-april-exploit/","name":"Aave and Kelp DAO Restore rsETH Operations — CryptoTimes","type":"news_article","credibility":2},{"url":"https://nftplazas.com/kelpdao-completes-rseth-recovery-layerzero-lockbox/","name":"KelpDAO Completed Final rsETH Transfer to LayerZero Lockbox — NFT Plazas","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Following the exploit and the breakdown in its relationship with LayerZero, KelpDAO announced the migration of rsETH bridging infrastructure from LayerZero's OFT (Omnichain Fungible Token) standard to Chainlink's Cross-Chain Interoperability Protocol (CCIP). KelpDAO stated that Chainlink's architecture requires multiple independent oracle networks to approve cross-chain transfers, contrasting with the single-verifier reliance that contributed to the April 2026 incident. The migration to Chainlink CCIP was reported by Unchained Crypto and Bitcoin.com News on or around May 5, 2026.","heading":"KelpDAO's Infrastructure Response: Migration to Chainlink CCIP","sources":[{"url":"https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","name":"KelpDAO Slams LayerZero, Shifts rsETH to Chainlink CCIP — Bitcoin.com News","type":"news_article","credibility":2},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Kelp DAO Claims LayerZero Approved the Setup, Migrates to Chainlink — Unchained Crypto","type":"news_article","credibility":2}],"severity":"low"},{"content":"Security researchers and industry commentators identified the exploit as a paradigm-shifting event for DeFi security. OpenZeppelin noted that standard smart contract audits examine code logic but typically exclude third-party integration configuration, off-chain infrastructure single points of failure, and system behavior when external dependencies are compromised. Because all on-chain signatures and smart contract calls appeared legitimate, the attack defeated conventional monitoring tools. Hypernative observed that only cross-chain invariant monitoring — comparing burn events on source chains against mint or release events on destination chains in real time — could have detected the mismatch. Crypto.news reported that DeFi protocols had lost $1.3 billion to hacks in 2026 by mid-year, with the KelpDAO incident accounting for the majority of that total. The incident prompted broader industry discussion about the systemic risk of single-verifier bridge configurations; approximately 47% of active LayerZero OApp contracts were using 1-of-1 DVN setups at the time of the exploit, representing roughly $4.5 billion in at-risk value across the ecosystem.","heading":"Broader Industry Impact and Security Implications","sources":[{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found — OpenZeppelin","type":"research","credibility":2},{"url":"https://crypto.news/defi-hacks-2026-billion-lost-same-attack-keeps-working/","name":"DeFi has lost $1.3 billion to hacks in 2026 — Crypto.news","type":"news_article","credibility":2},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Kelp DAO Claims LayerZero Approved the Setup — Unchained Crypto","type":"news_article","credibility":2}],"severity":"high"}],"timeline":[{"date":"2026-03-06","event":"According to LayerZero's incident report, a LayerZero Labs developer was socially engineered into cloning a malicious GitHub repository, which installed malware on their system and allowed the attacker to harvest session keys and access LayerZero's RPC cloud environment.","source":"LayerZero Labs KelpDAO Incident Report","source_url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"},{"date":"2026-04-18","event":"At approximately 17:35 UTC, attacker executes three transactions, submitting a forged LayerZero cross-chain message. KelpDAO's bridge escrow releases 116,500 rsETH (~$292 million) against a burn transaction that never occurred on the source chain. Stolen rsETH deposited into Aave V3 as collateral to borrow approximately $190–$236 million in WETH.","source":"Hypernative / CoinDesk","source_url":"https://www.hypernative.io/insights/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed"},{"date":"2026-04-19","event":"Aave V3 freezes all rsETH and wrsETH reserves across deployments, sets LTV to zero. DeFi contagion triggers reported $8–10 billion in deposit outflows from Aave. Bloomberg reports incident as largest crypto hack of 2026.","source":"CoinDesk / Bloomberg","source_url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos"},{"date":"2026-04-20","event":"LayerZero issues initial statement blaming KelpDAO's 1-of-1 DVN configuration and attributing the attack to North Korea's Lazarus Group. KelpDAO issues a counter-statement claiming LayerZero's default settings caused the disaster.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-04-23","event":"Aave rallies DeFi partners — including Mantle, Lido DAO, EtherFi, and LayerZero — to form the DeFi United coalition to restore rsETH backing and cover Aave's bad debt.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack"},{"date":"2026-04-28","event":"DeFi United coalition releases detailed technical recovery proposal for restoring rsETH backing.","source":"CoinDesk / The Block","source_url":"https://www.coindesk.com/tech/2026/04/28/a-crypto-coalition-releases-technical-proposal-to-save-aave-users-from-a-massive-token-exploit"},{"date":"2026-05-05","event":"KelpDAO publishes detailed memo asserting that LayerZero personnel directly approved the single-verifier configuration across approximately eight integration meetings over roughly two and a half years. KelpDAO announces migration of rsETH bridging from LayerZero to Chainlink CCIP.","source":"CoinDesk / Unchained Crypto","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05-09","event":"LayerZero reverses course, publicly admitting: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions. We own that.' LayerZero announces it will no longer service 1-of-1 DVN configurations and will migrate all defaults to a minimum of 3-of-3.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"date":"2026-05-18","event":"LayerZero Labs publishes its full public incident report detailing the attack timeline, social engineering vector, RPC compromise methodology, and attribution to DPRK TraderTraitor unit.","source":"LayerZero Labs Incident Report","source_url":"https://layerzero.network/publications/kelpdao-incident-report.pdf"},{"date":"2026-05-25","event":"KelpDAO and Aave jointly announce that rsETH has been fully restored. The final tranche of 20,373.7 rsETH is transferred to the LayerZero lockbox contract, completing recovery approximately five weeks after the exploit. All Aave markets and rsETH operations confirmed as functioning normally.","source":"CryptoTimes / NFT Plazas","source_url":"https://www.cryptotimes.io/2026/05/26/aave-and-kelp-dao-restore-rseth-operations-after-april-exploit/"}],"sources_used":[{"url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","name":"Inside the KelpDAO Bridge Exploit — Chainalysis","type":"research","archive_url":"http://web.archive.org/web/20260730015225/https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/","credibility":1,"archive_timestamp":"2026-07-30T01:52:25+00:00"},{"url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","name":"LayerZero Labs KelpDAO Incident Report (blog) — LayerZero","type":"official","archive_url":"http://web.archive.org/web/20260609083433/https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report","credibility":1,"archive_timestamp":"2026-06-09T08:34:33+00:00"},{"url":"https://layerzero.network/publications/kelpdao-incident-report.pdf","name":"LayerZero Labs KelpDAO Incident Report (PDF) — LayerZero","type":"official","archive_url":"http://web.archive.org/web/20260920082847/https://layerzero.network/publications/kelpdao-incident-report.pdf","credibility":1,"archive_timestamp":"2026-09-20T08:28:47+00:00"},{"url":"https://layerzero.network/blog/kelpdao-incident-statement","name":"KelpDAO Incident Statement — LayerZero","type":"official","archive_url":"http://web.archive.org/web/20260806181836/https://layerzero.network/blog/kelpdao-incident-statement","credibility":1,"archive_timestamp":"2026-08-06T18:18:36+00:00"},{"url":"https://layerzero.network/blog/an-overdue-apology","name":"LayerZero Update / Overdue Apology — LayerZero Official Blog","type":"official","archive_url":"http://web.archive.org/web/20260811072211/https://layerzero.network/blog/an-overdue-apology","credibility":1,"archive_timestamp":"2026-08-11T07:22:11+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"Kelp DAO exploited for $292 million — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260804014915/https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","credibility":1,"archive_timestamp":"2026-08-04T01:49:15+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","name":"LayerZero blames Kelp's setup, attributes to Lazarus — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260806181827/https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus","credibility":1,"archive_timestamp":"2026-08-06T18:18:27+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","name":"Kelp DAO hits back at LayerZero — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260619205713/https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster","credibility":1,"archive_timestamp":"2026-06-19T20:57:13+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos","name":"Aave could face up to $230m in losses — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260608172650/https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos","credibility":1,"archive_timestamp":"2026-06-08T17:26:50+00:00"},{"url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack","name":"Aave rallies DeFi partners — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260806181827/https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack","credibility":1,"archive_timestamp":"2026-08-06T18:18:27+00:00"},{"url":"https://www.coindesk.com/tech/2026/04/28/a-crypto-coalition-releases-technical-proposal-to-save-aave-users-from-a-massive-token-exploit","name":"DeFi United technical proposal — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260429231203/https://www.coindesk.com/tech/2026/04/28/a-crypto-coalition-releases-technical-proposal-to-save-aave-users-from-a-massive-token-exploit","credibility":1,"archive_timestamp":"2026-04-29T23:12:03+00:00"},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"Kelp says LayerZero approved setup — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260801083712/https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","credibility":1,"archive_timestamp":"2026-08-01T08:37:12+00:00"},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"LayerZero says it made a mistake — CoinDesk","type":"news_article","archive_url":"http://web.archive.org/web/20260724213636/https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","credibility":1,"archive_timestamp":"2026-07-24T21:36:36+00:00"},{"url":"https://www.hypernative.io/insights/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed","name":"The KelpDAO Observation-Layer Exploit — Hypernative","type":"research","archive_url":"http://web.archive.org/web/20260920210644/https://www.hypernative.io/insights/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed","credibility":2,"archive_timestamp":"2026-09-20T21:06:44+00:00"},{"url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","name":"$292 Million Lost, Zero Bugs Found — OpenZeppelin","type":"research","archive_url":"http://web.archive.org/web/20260724211804/https://www.openzeppelin.com/news/lessons-from-kelpdao-hack","credibility":2,"archive_timestamp":"2026-07-24T21:18:04+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026","name":"Explained: The Kelp DAO Hack April 2026 — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260727012741/https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026","credibility":2,"archive_timestamp":"2026-07-27T01:27:41+00:00"},{"url":"https://dev.to/denniskim/kelpdao-layerzero-bridge-hack-a-sophisticated-attack-on-the-single-point-of-failure-in-off-chain-4m2n","name":"KelpDAO LayerZero Bridge Hack Technical Analysis — DEV Community","type":"research","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3","name":"LayerZero Post Mortem Shows Lazarus Group Stole $290M — The Defiant","type":"news_article","archive_url":"http://web.archive.org/web/20260526151125/https://thedefiant.io/news/hacks/lazarus-kelpdao-290m-layerzero-rpc-hack-da50p3","credibility":2,"archive_timestamp":"2026-05-26T15:11:25+00:00"},{"url":"https://thedefiant.io/news/security/layerzero-labs-security-incident-multisig-violation-rjuv1s","name":"LayerZero Admits Mistake in 1/1 DVN Setup — The Defiant","type":"news_article","archive_url":"http://web.archive.org/web/20260509011356/https://thedefiant.io/news/security/layerzero-labs-security-incident-multisig-violation-rjuv1s","credibility":2,"archive_timestamp":"2026-05-09T01:13:56+00:00"},{"url":"https://decrypt.co/364872/layerzero-pins-292m-kelpdao-bridge-hack-on-north-koreas-lazarus-group","name":"LayerZero Pins $292M KelpDAO Hack on Lazarus — Decrypt","type":"news_article","archive_url":"https://web.archive.org/web/20260920183838/https://decrypt.co/364872/layerzero-pins-292m-kelpdao-bridge-hack-on-north-koreas-lazarus-group","credibility":2,"archive_timestamp":"2026-09-20T18:38:38+00:00"},{"url":"https://www.crowdfundinsider.com/2026/04/275261-kelpdao-bridge-exploit-analysis-north-korean-hackers-steal-292-million-via-off-chain-attack/","name":"KelpDAO Bridge Exploit Analysis — Crowdfund Insider","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://www.crowdfundinsider.com/2026/05/278326-layerzero-apologizes-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup/","name":"LayerZero Apologizes, Admits Fault — Crowdfund Insider","type":"news_article","archive_url":"http://web.archive.org/web/20260514122818/https://www.crowdfundinsider.com/2026/05/278326-layerzero-apologizes-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup/","credibility":2,"archive_timestamp":"2026-05-14T12:28:18+00:00"},{"url":"https://unchainedcrypto.com/kelp-dao-disputes-layerzeros-account-of-the-290-million-exploit-escalating-blame-game/","name":"Kelp DAO Disputes LayerZero's Account — Unchained Crypto","type":"news_article","archive_url":"http://web.archive.org/web/20260729202424/https://unchainedcrypto.com/kelp-dao-disputes-layerzeros-account-of-the-290-million-exploit-escalating-blame-game/","credibility":2,"archive_timestamp":"2026-07-29T20:24:24+00:00"},{"url":"https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","name":"Kelp DAO Claims LayerZero Approved Setup, Migrates to Chainlink — Unchained Crypto","type":"news_article","archive_url":"http://web.archive.org/web/20260509090304/https://unchainedcrypto.com/kelp-dao-claims-layerzero-approved-the-setup-it-blamed-for-292-million-hack-migrates-to-chainlink/","credibility":2,"archive_timestamp":"2026-05-09T09:03:04+00:00"},{"url":"https://unchainedcrypto.com/aave-rallies-defi-partners-to-restore-rseth-backing-after-kelpdao-exploit/","name":"Aave Rallies DeFi Partners to Restore rsETH — Unchained Crypto","type":"news_article","archive_url":"http://web.archive.org/web/20260920210058/https://unchainedcrypto.com/aave-rallies-defi-partners-to-restore-rseth-backing-after-kelpdao-exploit/","credibility":2,"archive_timestamp":"2026-09-20T21:00:58+00:00"},{"url":"https://www.kucoin.com/news/flash/defi-united-raises-160m-to-cover-aave-bad-debt-from-kelpdao-exploit","name":"DeFi United Raises $160M to Cover Aave Bad Debt — KuCoin","type":"news_article","archive_url":"http://web.archive.org/web/20260727173437/https://www.kucoin.com/news/flash/defi-united-raises-160m-to-cover-aave-bad-debt-from-kelpdao-exploit","credibility":2,"archive_timestamp":"2026-07-27T17:34:37+00:00"},{"url":"https://www.theblock.co/post/399118/defi-united-detailed-plan","name":"DeFi United Unveils Plan to Restore rsETH — The Block","type":"news_article","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://ground.news/article/kelp-dao-completes-rseth-recovery-plan-after-292-million-exploit","name":"Kelp DAO Says rsETH Fully Restored — Ground News","type":"news_article","archive_url":"http://web.archive.org/web/20260913003357/https://ground.news/article/kelp-dao-completes-rseth-recovery-plan-after-292-million-exploit","credibility":2,"archive_timestamp":"2026-09-13T00:33:57+00:00"},{"url":"https://www.cryptotimes.io/2026/05/26/aave-and-kelp-dao-restore-rseth-operations-after-april-exploit/","name":"Aave and Kelp DAO Restore rsETH Operations — CryptoTimes","type":"news_article","archive_url":"http://web.archive.org/web/20260727103703/https://www.cryptotimes.io/2026/05/26/aave-and-kelp-dao-restore-rseth-operations-after-april-exploit/","credibility":2,"archive_timestamp":"2026-07-27T10:37:03+00:00"},{"url":"https://nftplazas.com/kelpdao-completes-rseth-recovery-layerzero-lockbox/","name":"KelpDAO Completes Final rsETH Transfer to LayerZero Lockbox — NFT Plazas","type":"news_article","archive_url":"https://web.archive.org/web/20260920210031/https://nftplazas.com/kelpdao-completes-rseth-recovery-layerzero-lockbox/","credibility":2,"archive_timestamp":"2026-09-20T21:00:31+00:00"},{"url":"https://crypto.news/defi-hacks-2026-billion-lost-same-attack-keeps-working/","name":"DeFi has lost $1.3 billion to hacks in 2026 — Crypto.news","type":"news_article","archive_url":"https://web.archive.org/web/20260920183835/https://crypto.news/defi-hacks-2026-billion-lost-same-attack-keeps-working/","credibility":2,"archive_timestamp":"2026-09-20T18:38:35+00:00"},{"url":"https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","name":"KelpDAO Slams LayerZero, Shifts to Chainlink CCIP — Bitcoin.com News","type":"news_article","archive_url":"http://web.archive.org/web/20260507042312/https://news.bitcoin.com/kelpdao-slams-layerzero-after-300m-exploit-shifts-rseth-to-chainlink-ccip/","credibility":2,"archive_timestamp":"2026-05-07T04:23:12+00:00"},{"url":"https://governance.aave.com/t/arfc-rseth-incident-funding-update/24740","name":"rsETH Incident Funding Update — Aave Governance","type":"official","archive_url":"http://web.archive.org/web/20260617063109/https://governance.aave.com/t/arfc-rseth-incident-funding-update/24740","credibility":1,"archive_timestamp":"2026-06-17T06:31:09+00:00"}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-06-21T17:06:27.584925+00:00","updated_at":"2026-09-20T21:26:18.894217+00:00"}}