Summary
Kelp (also known as Kelp DAO) is a liquid restaking protocol built on Ethereum and EigenLayer that issues rsETH, a liquid restaked token. In April 2026 the protocol suffered the largest DeFi exploit of 2026 to date when attackers, attributed to North Korea's Lazarus Group, drained approximately $292 million in rsETH through a compromised LayerZero cross-chain bridge configuration. The protocol and an industry coalition dubbed DeFi United are actively working to restore collateral and resume operations as of May 2026.
Connected Entities
1 entities- + 1 more
Timeline(11 events)
2023-11-01
Kelp DAO launches rsETH liquid restaking protocol on Ethereum and EigenLayer; Code4rena public audit completed.
2024-02-01
Kelp begins private token round for KELP governance token at $90 million fully diluted valuation.
2024-03-01
Kelp closes $9 million private token round led by SCB Limited and Laser Digital (Nomura) with participation from Bankless Ventures, Hypersphere, Draper Dragon, and others.
2025-04-30
Kelp discloses bug in fee minter contract causing excess rsETH minting; deposits and withdrawals paused. No user funds lost. Aave precautionarily freezes rsETH markets.
2026-04-18
Kelp DAO's LayerZero-powered cross-chain bridge exploited for approximately $292 million (116,500 rsETH). Attack attributed to North Korea's Lazarus Group (TraderTraitor). Kelp pauses contracts, blocking an alleged follow-up $95 million theft attempt.
2026-04-19
Exploit confirmed as largest DeFi hack of 2026. Aave, SparkLend, and Fluid freeze rsETH markets. Over $13 billion in DeFi TVL exits within 48 hours.
2026-04-20
Kelp DAO publicly alleges LayerZero's default configuration settings caused the exploit. Arbitrum Security Council freezes approximately $71 million in attacker funds on Arbitrum.
2026-04-27
DeFi United coalition — including Aave, Lido, EtherFi, Ethena, Mantle, and LayerZero — announces $300 million+ rescue plan to restore rsETH backing and compensate affected users.
2026-05-06
Kelp DAO publishes detailed memo alleging LayerZero personnel directly approved the vulnerable bridge configuration. Kelp announces migration from LayerZero OFT to Chainlink CCIP.
2026-05-09
LayerZero publicly acknowledges it 'made a mistake' in approving the vulnerable verification configuration used by Kelp's bridge.
2026-05-13
Kelp DAO and Aave announce plans to resume rsETH operations as recovery progresses; DeFi United coalition begins phased rsETH collateral restoration.
Decision Log
- hash: 3WnWFZU83a2uppSSU7iNShkqt3qpnZJcNXkCPHGqkERa
This investigation is cryptographically anchored to the Solana blockchain and source URLs are archived via the Internet Archive.
model: claude-sonnet-4-6
generated: 5/4/2026, 2:54:17 AM
last updated: 5/19/2026, 8:04:10 PM
avoid.net — verified advice for a post-truth world