Skip to main content
AVOID.NET

Kelp

avoid.net/kelp→59/100·100% conf.
[AI-DRAFTED · AWAITING FACT-CHECK][src:defillama]

Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 59. Problems weighed by who is responsible: incidents the subject suffered −3.2, problems around the subject, caused by others −3.2, concerns that are not fraud −3.2; legitimacy credit long-running +4. Version history →

Why this score
Every page starts at65
Concerns that are not fraud-3.2
Incidents it suffered (e.g. hacks)-3.2
Problems around it, caused by others-3.2
Long-running+4
Sum59

Score: 59/100 (kept between 0 and 100)

How scoring works →
anchored·C98L6K…BMST
last updated 2026-10-10

Summary

Kelp (also known as Kelp DAO) is a liquid restaking protocol built on Ethereum and EigenLayer that issues rsETH, a liquid restaked token. In April 2026 the protocol suffered the largest DeFi exploit of 2026 to date when attackers, attributed to North Korea's Lazarus Group, drained approximately $292 million in rsETH through a compromised LayerZero cross-chain bridge configuration. The protocol and an industry coalition dubbed DeFi United are actively working to restore collateral and resume operations as of May 2026.

Connected Entities

11 entities · 59 linked investigations
Organizations
□TraderTraitor / UNC48990□Kelp□Ethena55□Chainlink□Ethereum□Arbitrum□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□LayerZero Labs□Mantle□Eigenlayer
Protocols
⌂LayerZero — DVN Single-Verifier Configuration Risk
Relationships
  • Mantle→mentioned with→Ethereum(80%)
  • Ethena→mentioned with→Ethereum(75%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→TraderTraitor / UNC4899(70%)
  • Eigenlayer→mentioned with→Mantle(60%)
  • Eigenlayer→mentioned with→Ethereum(70%)
  • LayerZero Labs→mentioned with→Ethereum(60%)
  • LayerZero Labs→mentioned with→Chainlink(70%)
  • LayerZero Labs→mentioned with→Mantle(60%)
  • Chainlink→mentioned with→Ethereum(65%)
  • + 26 more
Have evidence about Kelp?

Timeline(11 events)

November 2023

Kelp DAO launches rsETH liquid restaking protocol on Ethereum and EigenLayer; Code4rena public audit completed.

February 2024

Kelp begins private token round for KELP governance token at $90 million fully diluted valuation.

March 2024

Kelp closes $9 million private token round led by SCB Limited and Laser Digital (Nomura) with participation from Bankless Ventures, Hypersphere, Draper Dragon, and others.

30 April 2025

Kelp discloses bug in fee minter contract causing excess rsETH minting; deposits and withdrawals paused. No user funds lost. Aave precautionarily freezes rsETH markets.

18 April 2026

Kelp DAO's LayerZero-powered cross-chain bridge exploited for approximately $292 million (116,500 rsETH). Attack attributed to North Korea's Lazarus Group (TraderTraitor). Kelp pauses contracts, blocking an alleged follow-up $95 million theft attempt.

19 April 2026

Exploit confirmed as largest DeFi hack of 2026. Aave, SparkLend, and Fluid freeze rsETH markets. Over $13 billion in DeFi TVL exits within 48 hours.

20 April 2026

Kelp DAO publicly alleges LayerZero's default configuration settings caused the exploit. Arbitrum Security Council freezes approximately $71 million in attacker funds on Arbitrum.

27 April 2026

DeFi United coalition — including Aave, Lido, EtherFi, Ethena, Mantle, and LayerZero — announces $300 million+ rescue plan to restore rsETH backing and compensate affected users.

6 May 2026

Kelp DAO publishes detailed memo alleging LayerZero personnel directly approved the vulnerable bridge configuration. Kelp announces migration from LayerZero OFT to Chainlink CCIP.

9 May 2026

LayerZero publicly acknowledges it 'made a mistake' in approving the vulnerable verification configuration used by Kelp's bridge.

13 May 2026

Kelp DAO and Aave announce plans to resume rsETH operations as recovery progresses; DeFi United coalition begins phased rsETH collateral restoration.

Provenance & Audit Trail

Decision Log

  • #2rescore+41Recorded on Solana ✓10/10/2026, 6:49:06 PM
    slot 455369149 · hash 4uzRn9pYbKmVnoUr7mBTUi7i5wA9whpLv84cKiTWzFdL
  • #1publishRecorded on Solana ✓5/19/2026, 8:04:10 PM
    slot 420837896 · hash 3WnWFZU83a2uppSSU7iNShkqt3qpnZJcNXkCPHGqkERa

This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 17 of 21 cited source URLs have an Internet Archive snapshot.

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:17 AM

last updated: 10/10/2026, 6:49:06 PM

5 views

avoid.net — verified advice for a post-truth world