{"investigation":{"slug":"kelpdao-layerzero-bridge-exploit-april-2026-dprk-lazarus","entity_name":"KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus","trust_score":0,"severity_base":null,"score_modifier":-19.68,"confidence":0.91,"status":"under_investigation","content_type":"investigation","summary":"On April 18, 2026, an attacker drained roughly 116,500 rsETH (about $292 million) from Kelp DAO's LayerZero-powered cross-chain bridge by compromising the infrastructure behind LayerZero's message verifier rather than any smart contract. LayerZero has said preliminary indicators point to North Korea's Lazarus Group (specifically the TraderTraitor subgroup), though it describes this as a probabilistic assessment, not a confirmed finding. The loss triggered contagion into Aave's lending markets, a partial recovery by the Arbitrum Security Council, a multi-protocol bailout effort called DeFi United, and a still-unresolved lawsuit in which Kelp DAO's corporate entity accuses LayerZero and its co-founder of concealing the risks of the bridge configuration involved.","sections":[{"content":"An attacker drained 116,500 rsETH — then worth approximately $292 million and roughly 18% of circulating supply — from Kelp DAO's LayerZero-powered bridge on April 18, 2026, at 17:35 UTC. Kelp DAO froze the protocol's core contracts 46 minutes later, at 18:21 UTC. Two follow-up drain attempts at 18:26 and 18:28 UTC, each seeking roughly 40,000 additional rsETH, were reverted. Kelp DAO publicly acknowledged the incident on social media at 20:10 UTC, nearly three hours after the initial drain. The stolen rsETH was left stranded as unbacked tokens across more than 20 blockchain networks, since the bridge's cross-chain supply had been inflated without a corresponding burn on the source chain.","heading":"The Exploit: Timeline and Scale","sources":[{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"CoinDesk: Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/397988/kelp-daos-rseth-bridge-apparently-exploited-for-roughly-292-million-in-layerzero-based-attack","name":"The Block: Kelp DAO's rsETH bridge apparently exploited for roughly $292 million in LayerZero-based attack","type":"news_article","credibility":2}],"severity":"critical"},{"content":"LayerZero's own account of the incident, issued after an initial postmortem and a later, more detailed apology, describes a two-pronged infrastructure attack rather than a smart-contract bug. According to LayerZero, attackers compromised internal RPC nodes used by its Decentralized Verifier Network (DVN) by swapping out their software binaries, poisoning the data those nodes fed into the verification process, while simultaneously running a distributed denial-of-service attack against LayerZero's external RPC providers to force a failover onto the compromised nodes. Because Kelp DAO's rsETH bridge used a single DVN in a 1-of-1 configuration — with no second, independent verifier to cross-check the message — the forged confirmation that tokens had been burned on the source chain was accepted, allowing new rsETH to be minted on destination chains without any real burn. LayerZero's incident report states that the rsETH deployment had at some earlier point used a 2-of-2 DVN configuration and was later changed to 1-of-1, though LayerZero's report does not specify when this change occurred or who made it — a point of continuing dispute between the two companies (see below).","heading":"Attack Mechanics: RPC Compromise and a Single-Verifier Configuration","sources":[{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero says North Korea's Lazarus likely behind Kelp DAO exploit; blames single-point setup","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-05-09-layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup-400629","name":"The Block: LayerZero issues public apology for Kelp DAO exploit response, admits fault in single-verifier setup","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/hacks/layerzero-s-incident-report-says-kelp-downgraded-from-2-of-2-to-1-of-1-before-usd292m-exploit","name":"The Defiant: LayerZero's Incident Report Says Kelp Downgraded From 2-of-2 to 1-of-1 DVN Before $292M Exploit","type":"news_article","credibility":2}],"severity":"critical"},{"content":"LayerZero's statement on the exploit said: \"Preliminary indicators suggest attribution to a highly-sophisticated state actor, likely DPRK's Lazarus Group,\" naming the Lazarus-affiliated TraderTraitor subgroup more specifically in later remarks. This is LayerZero's own hedged assessment — it is described as preliminary and probabilistic, not a confirmed finding by an independent government agency or forensic authority. Blockchain analytics firm TRM Labs separately attributed the KelpDAO breach to TraderTraitor in a report on North Korea-linked crypto theft, and grouped it with a separate April 1, 2026 exploit of Drift Protocol (about $285 million) as the two largest attacks behind North Korea's roughly $577 million in combined 2026 theft through April, about 76% of all crypto hack losses tracked in that period. TRM treats the Drift Protocol attribution as a different, still-under-investigation North Korean subgroup, so readers should not conflate the two incidents' attributions.","heading":"Attribution to North Korea's Lazarus Group / TraderTraitor","sources":[{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero says North Korea's Lazarus likely behind Kelp DAO exploit; blames single-point setup","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"TRM Labs: North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks","type":"research","credibility":2},{"url":"https://unchainedcrypto.com/layerzero-links-292-million-kelp-dao-bridge-exploit-to-north-koreas-lazarus-group/","name":"Unchained: LayerZero links $292 million Kelp DAO bridge exploit to North Korea's Lazarus Group","type":"news_article","credibility":2}],"severity":"high"},{"content":"LayerZero's first postmortem stated the protocol \"functioned exactly as intended\" and placed responsibility on Kelp DAO's choice of a 1-of-1 DVN configuration with no redundancy, saying it and other parties had recommended DVN diversification but Kelp chose the single-verifier setup. Kelp disputed this, saying LayerZero personnel had reviewed and approved the 1-of-1 configuration in writing, and pointed to an April 19, 2026 public post by Spearbit security researcher Sujith Somraaj stating he had submitted a bug bounty report describing the same attack pattern before the exploit and that LayerZero rejected it as out of scope, since the bounty program covered the LayerZero protocol itself rather than application-level configuration choices. On May 8–9, 2026, LayerZero issued what multiple outlets described as an \"overdue apology,\" stating it \"made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions,\" and disclosing that Lazarus Group had poisoned its internal RPC infrastructure while DDoSing an external provider. LayerZero said its DVN no longer services 1-of-1 configurations. The fallout included Kraken reportedly replacing LayerZero with Chainlink's CCIP, and Solv Protocol moving more than $700 million in tokenized bitcoin infrastructure away from LayerZero, according to industry reporting.","heading":"Disputed Responsibility: Kelp DAO vs. LayerZero","sources":[{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"CoinDesk: Kelp claims that LayerZero approved the setup it blamed for $292 million bridge hack","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"CoinDesk: LayerZero says it 'made a mistake' in $292 Million Kelp exploit","type":"news_article","credibility":2},{"url":"https://www.analyticsinsight.net/news/kraken-dumps-layerzero-for-chainlink-ccip-after-kelp-hack","name":"Analytics Insight: Kraken Dumps LayerZero for Chainlink CCIP After Kelp Hack","type":"news_article","credibility":3}],"severity":"high"},{"content":"The attacker posted a portion of the fraudulently minted rsETH as collateral on Aave's V3 and V4 markets across multiple chains and borrowed against it; a breakdown reported by Forbes put the Arbitrum-side positions at roughly 29,782 WETH plus 821 wstETH, with additional borrowing of about 52,834 WETH on Ethereum. News outlets have reported total borrowed amounts ranging from roughly $190 million to $236 million, a range that reflects differing methodologies rather than an agreed figure, so it should be treated as approximate and disputed rather than a single confirmed number. Aave froze its rsETH markets on V3 and V4 within hours, and on April 19–20 adjusted interest-rate models and froze WETH markets on its Core, Prime, Arbitrum, Base, Mantle and Linea deployments to prevent new borrows and limit spillover. Aave's own incident analysis estimated resulting bad debt at approximately $123.7 million if losses were spread across all rsETH holders, or approximately $230.1 million if isolated to Layer-2 rsETH positions; outlets have commonly cited a headline figure of about $195 million. Aave stated its core smart contracts were not directly exploited. Reported deposit outflows following the incident ranged from about $6.6 billion within a day to roughly $8 billion below pre-attack levels five months later, according to one outlet's tracking of Aave's total value locked.","heading":"Contagion Into Aave's Lending Markets","sources":[{"url":"https://www.forbes.com/sites/digital-assets/2026/04/18/withdraw-now-inside-aaves-sudden-200m-bad-debt-crisis/","name":"Forbes: AAVE wETH Exploit: $200M Bad Debt Hits Depositors","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/business/2026/04/26/aave-raises-nearly-80-of-the-usd200-million-it-needs-to-cover-bad-debt-left-by-kelp-dao-exploit","name":"CoinDesk: Arkham says Aave raised $160 million of the $200 million it needs to cover exploit damage","type":"news_article","credibility":2},{"url":"https://beincrypto.com/aave-missing-8-billion-kelp-hack/","name":"BeInCrypto: Five Months After the Kelp Hack, Aave Is Still Down $8 Billion","type":"news_article","credibility":2}],"severity":"high"},{"content":"The Arbitrum Security Council took emergency action to freeze 30,766 ETH tied to the exploit, moving it into an intermediary wallet on Arbitrum One; the transfer completed at 11:26 p.m. ET on April 20, 2026, according to Arbitrum's own statement. The frozen amount was reported as approximately $71 million by CoinDesk and approximately $71.5 million by Decrypt — figures in the same range, not a $75 million figure, which no source consulted supports. One report indicates the council vote was 9-of-12 in favor. The council said the funds are \"no longer accessible to the address that originally held the funds\" and that any further movement requires formal authorization from Arbitrum governance, coordinated with relevant parties, which multiple outlets described as including law enforcement input on the exploiter's identity. This freeze is a containment measure; the funds have not been returned to Kelp DAO or affected users, and the freeze does not resolve the separate blame dispute between Kelp DAO and LayerZero.","heading":"Arbitrum Security Council Freeze","sources":[{"url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","name":"CoinDesk: Arbitrum freezes $71 million in ether tied to Kelp DAO exploit","type":"news_article","credibility":2},{"url":"https://decrypt.co/364981/arbitrum-security-council-freezes-71-5m-in-ethereum-linked-to-292m-kelpdao-exploit","name":"Decrypt: Arbitrum Security Council Freezes $71.5M in Ethereum Linked to $292M KelpDAO Exploit","type":"news_article","credibility":2}],"severity":"medium"},{"content":"On-chain analytics firm Arkham tracked roughly 75,700 ETH (about $175 million) — the portion of the stolen funds that was not frozen by Arbitrum — moved by the exploiter across three transactions, with much of it routed through the cross-chain liquidity protocol THORChain and the privacy protocol Umbra before being swapped into Bitcoin; one report described nearly all of this unfrozen portion as ultimately converted to BTC. TRM Labs separately noted that THORChain \"processed the vast majority of proceeds\" from both North Korea's 2025 Bybit hack and the 2026 KelpDAO hack, without providing a combined dollar or percentage figure specific to the two 2026 DPRK-linked attacks. No source found in this research supports a precise figure of $1.2 billion or 85% of proceeds moving through THORChain specifically from the two 2026 attacks (KelpDAO and Drift Protocol, which together totaled roughly $577 million according to TRM Labs); a $1.2 billion THORChain figure appears in reporting only in connection with the separate, larger 2025 Bybit hack, and applying it to the 2026 attacks would be mathematically inconsistent with their combined total. That specific combined claim is not included here for lack of a verifiable source.","heading":"Laundering of Stolen Funds","sources":[{"url":"https://cointelegraph.com/news/kelp-dao-hacker-launders-nearly-all-75700-eth-through-thorchain","name":"Cointelegraph: Kelp DAO exploiter launders nearly all 75,700 in stolen ETH through THORchain","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/kelp-exploiter-moves-175m-stolen-funds","name":"Cointelegraph: Kelp Exploiter Moves $175M of Stolen Funds: Arkham","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"TRM Labs: North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks","type":"research","credibility":2}],"severity":"medium"},{"content":"Aave service providers organized a multi-protocol recovery effort, publicly referred to as \"DeFi United,\" aiming to raise roughly 100,000 ETH to restore rsETH's backing and cover Aave's resulting shortfall. Reported pledges included a proposed loan of up to 30,000 ETH from Mantle to Aave DAO (conditional on an Aave governance vote and delegation of AAVE tokens to Mantle), a pending Aave DAO governance proposal, 5,000 ETH pledged personally by Aave founder Stani Kulechov, a proposed 5,000 ETH from the Ether.fi Foundation, up to 2,500 stETH from the Lido Labs Foundation, and 1,000 ETH from the Golem Foundation, with additional named participants including Ethena, Ink Foundation, Tydro, Frax Finance and LayerZero itself. By April 26, 2026, on-chain analytics firm Arkham reported that roughly $160 million of the approximately $200 million target had been raised. Reporting on cumulative progress is inconsistent between outlets, with figures ranging from about 69,500 to 73,700 ETH committed against the 100,000 ETH goal. The Arbitrum Security Council's separately frozen 30,766 ETH, discussed above, is a distinct pool tied up in exploit-recovery and law-enforcement coordination; it was not treated as part of these fresh DeFi United pledges in the reporting reviewed, and any proposal to redirect those frozen funds into Aave's rescue would require a separate governance process.","heading":"Recovery Effort: The \"DeFi United\" Coalition","sources":[{"url":"https://thedefiant.io/news/defi/defi-united-fundraising-chips-away-at-kelp-exploit-shortfall","name":"The Defiant: DeFi United Fundraising Chips Away at Kelp Exploit Shortfall","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/04/26/aave-raises-nearly-80-of-the-usd200-million-it-needs-to-cover-bad-debt-left-by-kelp-dao-exploit","name":"CoinDesk: Arkham says Aave raised $160 million of the $200 million it needs to cover exploit damage","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/28/a-crypto-coalition-releases-technical-proposal-to-save-aave-users-from-a-massive-token-exploit","name":"CoinDesk: A crypto coalition releases technical proposal to save Aave users from a massive token exploit","type":"news_article","credibility":2}],"severity":"low"},{"content":"Evercrest Technologies Inc., the corporate entity behind Kelp DAO, filed a notice of civil claim against LayerZero Labs Ltd. and LayerZero co-founder Bryan Pellegrino in British Columbia, Canada (Vancouver Law Courts, case file number 267169), with the suit publicly announced around September 24–25, 2026. Kelp DAO's filing states: \"The exploit was a direct result of LayerZero's failures, including a failure to disclose weaknesses and risks,\" and separately alleges that \"LayerZero and Mr. Pellegrino publicly blamed us for their failures,\" with at least one outlet describing the claim as including allegations of negligence and defamation in addition to the disclosure allegations. Pellegrino responded that \"the claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly.\" No court has ruled on the allegations as of this writing; they remain Kelp DAO's unproven claims.","heading":"Litigation: Kelp DAO's Evercrest Technologies Sues LayerZero and Co-Founder","sources":[{"url":"https://www.coindesk.com/business/2026/09/25/kelpdao-sues-layerzero-for-the-largest-exploit-2026-has-seen-so-far","name":"CoinDesk: KelpDAO sues LayerZero for the largest exploit 2026 has seen so far","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/kelp-dao-sues-layerzero-co-074920981.html","name":"Yahoo Finance: Kelp DAO Sues LayerZero and Co-Founder Over $292 Million rsETH Exploit","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/regulation-and-legal/kelpdao-takes-layerzero-to-court-over-a-292m-bridge-blowup/","name":"Bitcoin.com News: KelpDAO Takes Layerzero to Court Over a $292M Bridge Blowup","type":"news_article","credibility":2}],"severity":"high"},{"content":"On May 5, 2026, Kelp DAO announced it would migrate the rsETH bridge away from LayerZero's OFT standard to Chainlink's Cross-Chain Interoperability Protocol (CCIP), adopting Chainlink's Cross-Chain Token (CCT) standard. Chainlink stated that roughly $4 billion in value shifted toward CCIP-connected infrastructure in the weeks following the exploit, a figure sourced to Chainlink itself rather than an independent tally; one industry outlet cited a higher figure of over $7 billion in token value moved onto Chainlink's cross-chain infrastructure across the quarter following a wider wave of bridge hacks, of which the KelpDAO exploit was one. Reporting reviewed did not confirm whether Kelp DAO's migration has been fully completed.","heading":"Remediation: Kelp DAO's Migration to Chainlink CCIP","sources":[{"url":"https://www.theblock.co/news/ecosystems/2026-05-05-kelp-dao-ditches-layerzero-chainlink-cross-chain-infrastructure-292-million-exploit-400131","name":"The Block: Kelp DAO ditches LayerZero for Chainlink's cross-chain infrastructure following $292 million exploit","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/chainlink-says-4-billion-shifted-143600356.html","name":"Yahoo Finance: Chainlink Says $4 Billion Shifted to CCIP After KelpDAO Bridge Exploit","type":"news_article","credibility":2}],"severity":"low"},{"content":"Kelp DAO is a liquid-restaking protocol that issues rsETH, a token representing staked and restaked ETH deployed to EigenLayer operators, and operates associated \"Gain Vault\" yield products on multiple Layer-2 networks; one source reports rsETH launched in 2023 and that total value locked exceeded $950 million by mid-2024. A single lower-tier source names Amitej G. and Dheeraj B. — also described as founders of Stader Labs — as Kelp DAO's founders; this research could not independently corroborate that claim with a Tier 1 or Tier 2 source, so it is flagged as low-confidence background rather than an established fact. Beyond this, this investigation did not find reliable, independently verifiable detail on Kelp DAO's founding history, funding, or governance structure prior to the April 2026 exploit; that gap in the public record should be treated as an open question rather than filled with inference.","heading":"Background: Kelp DAO's Protocol and Coverage Gaps","sources":[{"url":"https://www.kucoin.com/blog/vn-kelpdao-hack-2026-rseth-exploit-analysis","name":"KuCoin Learn: What Is KelpDAO? How Its $292M Hack Shook the Crypto Market in 2026","type":"other","credibility":3},{"url":"https://alearesearch.substack.com/p/kelp-dao-what-you-need-to-know","name":"Alea Research: Kelp DAO — what you need to know","type":"other","credibility":3}],"severity":"low"}],"timeline":[{"date":"2026-04-18","event":"Attacker drains 116,500 rsETH (approx. $292 million) from Kelp DAO's LayerZero-powered cross-chain bridge via a compromised single-verifier (1-of-1 DVN) configuration; Kelp DAO freezes core contracts within the hour and two follow-up drain attempts are reverted.","source":"CoinDesk / TRM Labs","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","date_evidence":"The KelpDAO breach on April 18 targeted its rsETH LayerZero bridge on Ethereum."},{"date":"2026-04-20","event":"Arbitrum Security Council completes an emergency freeze of 30,766 ETH (approx. $71 million) tied to the exploiter, moving it into an intermediary wallet pending governance action.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","date_evidence":"The transfer completed at 11:26 p.m. ET on April 20, according to Arbitrum's statement on X."},{"date":"2026-04","event":"Aave freezes rsETH markets on V3 and V4 and later freezes WETH markets across several deployments (Core, Prime, Arbitrum, Base, Mantle, Linea) to contain contagion from unbacked rsETH collateral; Aave service providers launch the \"DeFi United\" recovery coalition targeting roughly 100,000 ETH in pledges.","source":"Forbes / The Defiant","source_url":"https://www.forbes.com/sites/digital-assets/2026/04/18/withdraw-now-inside-aaves-sudden-200m-bad-debt-crisis/"},{"date":"2026-04","event":"Arkham reports that Aave's DeFi United effort has raised approximately $160 million of the roughly $200 million needed to cover bad debt from the exploit.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/04/26/aave-raises-nearly-80-of-the-usd200-million-it-needs-to-cover-bad-debt-left-by-kelp-dao-exploit","date_original":"2026-04-26"},{"date":"2026-05","event":"Kelp DAO announces it will migrate its rsETH bridge from LayerZero's OFT standard to Chainlink's CCIP/CCT standard.","source":"The Block","source_url":"https://www.theblock.co/news/ecosystems/2026-05-05-kelp-dao-ditches-layerzero-chainlink-cross-chain-infrastructure-292-million-exploit-400131"},{"date":"2026-05","event":"LayerZero issues a public apology, admitting it \"made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions,\" and discloses that Lazarus Group poisoned its internal RPC infrastructure while DDoSing an external provider.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"date":"2026-09","event":"Evercrest Technologies Inc. (Kelp DAO) files a civil claim against LayerZero Labs Ltd. and co-founder Bryan Pellegrino in British Columbia, Canada, alleging failure to disclose risks, negligence and defamation; LayerZero's Pellegrino calls the claim meritless.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/09/25/kelpdao-sues-layerzero-for-the-largest-exploit-2026-has-seen-so-far"}],"sources_used":[{"url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains","name":"CoinDesk: Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/397988/kelp-daos-rseth-bridge-apparently-exploited-for-roughly-292-million-in-layerzero-based-attack","name":"The Block: Kelp DAO's rsETH bridge apparently exploited for roughly $292 million in LayerZero-based attack","type":"news_article","credibility":2},{"url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus","name":"The Block: LayerZero says North Korea's Lazarus likely behind Kelp DAO exploit; blames single-point setup","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-05-09-layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup-400629","name":"The Block: LayerZero issues public apology for Kelp DAO exploit response, admits fault in single-verifier setup","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/hacks/layerzero-s-incident-report-says-kelp-downgraded-from-2-of-2-to-1-of-1-before-usd292m-exploit","name":"The Defiant: LayerZero's Incident Report Says Kelp Downgraded From 2-of-2 to 1-of-1 DVN Before $292M Exploit","type":"news_article","credibility":2},{"url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks","name":"TRM Labs: North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks","type":"research","credibility":2},{"url":"https://unchainedcrypto.com/layerzero-links-292-million-kelp-dao-bridge-exploit-to-north-koreas-lazarus-group/","name":"Unchained: LayerZero links $292 million Kelp DAO bridge exploit to North Korea's Lazarus Group","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack","name":"CoinDesk: Kelp claims that LayerZero approved the setup it blamed for $292 million bridge hack","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit","name":"CoinDesk: LayerZero says it 'made a mistake' in $292 Million Kelp exploit","type":"news_article","credibility":2},{"url":"https://www.analyticsinsight.net/news/kraken-dumps-layerzero-for-chainlink-ccip-after-kelp-hack","name":"Analytics Insight: Kraken Dumps LayerZero for Chainlink CCIP After Kelp Hack","type":"news_article","credibility":3},{"url":"https://www.forbes.com/sites/digital-assets/2026/04/18/withdraw-now-inside-aaves-sudden-200m-bad-debt-crisis/","name":"Forbes: AAVE wETH Exploit: $200M Bad Debt Hits Depositors","type":"news_article","credibility":1},{"url":"https://www.coindesk.com/business/2026/04/26/aave-raises-nearly-80-of-the-usd200-million-it-needs-to-cover-bad-debt-left-by-kelp-dao-exploit","name":"CoinDesk: Arkham says Aave raised $160 million of the $200 million it needs to cover exploit damage","type":"news_article","credibility":2},{"url":"https://beincrypto.com/aave-missing-8-billion-kelp-hack/","name":"BeInCrypto: Five Months After the Kelp Hack, Aave Is Still Down $8 Billion","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit","name":"CoinDesk: Arbitrum freezes $71 million in ether tied to Kelp DAO exploit","type":"news_article","credibility":2},{"url":"https://decrypt.co/364981/arbitrum-security-council-freezes-71-5m-in-ethereum-linked-to-292m-kelpdao-exploit","name":"Decrypt: Arbitrum Security Council Freezes $71.5M in Ethereum Linked to $292M KelpDAO Exploit","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/kelp-dao-hacker-launders-nearly-all-75700-eth-through-thorchain","name":"Cointelegraph: Kelp DAO exploiter launders nearly all 75,700 in stolen ETH through THORchain","type":"news_article","credibility":2},{"url":"https://cointelegraph.com/news/kelp-exploiter-moves-175m-stolen-funds","name":"Cointelegraph: Kelp Exploiter Moves $175M of Stolen Funds: Arkham","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/defi/defi-united-fundraising-chips-away-at-kelp-exploit-shortfall","name":"The Defiant: DeFi United Fundraising Chips Away at Kelp Exploit Shortfall","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/tech/2026/04/28/a-crypto-coalition-releases-technical-proposal-to-save-aave-users-from-a-massive-token-exploit","name":"CoinDesk: A crypto coalition releases technical proposal to save Aave users from a massive token exploit","type":"news_article","credibility":2},{"url":"https://www.coindesk.com/business/2026/09/25/kelpdao-sues-layerzero-for-the-largest-exploit-2026-has-seen-so-far","name":"CoinDesk: KelpDAO sues LayerZero for the largest exploit 2026 has seen so far","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/kelp-dao-sues-layerzero-co-074920981.html","name":"Yahoo Finance: Kelp DAO Sues LayerZero and Co-Founder Over $292 Million rsETH Exploit","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/regulation-and-legal/kelpdao-takes-layerzero-to-court-over-a-292m-bridge-blowup/","name":"Bitcoin.com News: KelpDAO Takes Layerzero to Court Over a $292M Bridge Blowup","type":"news_article","credibility":2},{"url":"https://www.theblock.co/news/ecosystems/2026-05-05-kelp-dao-ditches-layerzero-chainlink-cross-chain-infrastructure-292-million-exploit-400131","name":"The Block: Kelp DAO ditches LayerZero for Chainlink's cross-chain infrastructure following $292 million exploit","type":"news_article","credibility":2},{"url":"https://finance.yahoo.com/markets/crypto/articles/chainlink-says-4-billion-shifted-143600356.html","name":"Yahoo Finance: Chainlink Says $4 Billion Shifted to CCIP After KelpDAO Bridge Exploit","type":"news_article","credibility":2},{"url":"https://www.kucoin.com/blog/vn-kelpdao-hack-2026-rseth-exploit-analysis","name":"KuCoin Learn: What Is KelpDAO? How Its $292M Hack Shook the Crypto Market in 2026","type":"other","credibility":3},{"url":"https://alearesearch.substack.com/p/kelp-dao-what-you-need-to-know","name":"Alea Research: Kelp DAO — what you need to know","type":"other","credibility":3}],"source_tags":[],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-07-29T12:05:57.00602+00:00","updated_at":"2026-10-28T00:51:53.975+00:00"},"source_quality":{"total":26,"tier1":0,"tier2":16,"tier3":0,"unrated":10},"follower_count":null,"content_updated_at":"2026-10-28T00:51:54.643Z","last_fact_checked_at":"2026-10-28T00:51:54.320Z","fact_check_next_allowed_at":"2026-11-04T00:51:54.320Z","update_next_allowed_at":"2026-11-03T20:28:47.319Z"}