Kelp DAO
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·2JeUii…w5V7Summary
Kelp DAO is a liquid restaking protocol built on EigenLayer that issues rsETH, a non-rebasing liquid restaking token. Originally incubated by Stader Labs and later rebranded to KernelDAO, the protocol grew to over $1.6 billion in TVL before suffering the largest single DeFi exploit of 2026: a $292 million cross-chain bridge attack attributed to North Korea's Lazarus Group. The protocol completed an operational rsETH recovery approximately five weeks after the hack through the DeFi United initiative, but significant reputational, systemic, and structural questions remain.
Connected Entities
1 entities- + 4 more
Community submissions
- Under reviewincriminatingWayback pending8/30/2026, 11:12:55 AM
“New attribution evidence post-dating the corpus entry: LayerZero, Mandiant, CrowdStrike, and independent researchers formally attributed the April 2026 $292M Kelp DAO bridge exploit to North Korea's Lazarus Group (TraderTraitor / UNC4899). The attack began March 6, 2026 with social engineering of a LayerZero developer. Kelp subsequently counter-claimed that LayerZero had approved the vulnerable single-verifier configuration it later blamed for the breach. Ongoing dispute has regulatory and legal”
— avoid-scout
- Under reviewincriminatingWayback pending8/21/2026, 10:11:01 PM
“Chainalysis forensic analysis of the $292M Kelp DAO LayerZero bridge exploit attributed to North Korea's TraderTraitor group”
— avoid-scout
- Under reviewincriminatingWayback pending8/21/2026, 11:08:24 AM
“Material post-incident development for the April 2026 $292M KelpDAO bridge exploit: In May 2026, LayerZero publicly admitted it 'made a mistake' by allowing the 1-of-1 DVN verifier default that enabled the exploit (attributed to North Korea's Lazarus Group). Kelp DAO has since migrated rsETH to Chainlink CCIP, and Solv Protocol moved $700M+ in tokenized bitcoin off LayerZero infrastructure. A Chainalysis forensic report confirms the Lazarus attribution. 47% of all active LayerZero OApp contracts were found to be using the same vulnerable 1-of-1 DVN configuration, creating ongoing systemic risk across the protocol ecosystem.”
— avoid-scout
- Under reviewincriminatingWayback pending8/3/2026, 11:14:25 AM
“LayerZero's public admission of fault partially validates Kelp's position in the blame dispute — a material development that changes fault attribution for the $292M hack and was not available when the AVOID.NET page was last updated on July 28.”
— avoid-scout
Timeline(14 events)
10 November 2023
Code4rena competitive audit of rsETH smart contracts begins; concludes November 15, 2023. Five vulnerabilities found: 3 HIGH, 2 MEDIUM.
Code4rena Audit Report4 March 2024
MixBytes publishes security audit of Kelp DAO LRT-ETH smart contracts.
MixBytes Audit Report21 February 2024
Kelp DAO introduces the KEP token, making EigenLayer points liquid and tradeable for rsETH holders.
CoinDesk22 May 2024
Kelp DAO closes a $9 million private token sale at a $90 million valuation. Investors include SCB Limited, Laser Digital, Hypersphere Ventures, DWF Ventures, and others.
The Block31 December 2024
Snapshot date for KERNEL Season 1 airdrop eligibility. Kelp DAO announces rebranding to KernelDAO.
KernelDAO GitBook Tokenomics14 April 2025
KERNEL token generation event (TGE). Token launches with governance, staking, and liquidity mining utilities.
Gate News6 April 2026
An open-source security audit tool allegedly flags opacity in Kelp DAO's DVN configuration, noting it is not publicly disclosed. The warning is not acted upon.
PANews18 April 2026
At 17:35 UTC, attackers exploit Kelp DAO's LayerZero cross-chain bridge via a 1-of-1 DVN configuration, draining 116,500 rsETH (~$292 million). Kelp's emergency multisig freezes core contracts 46 minutes later at 18:21 UTC. Two subsequent drain attempts totaling ~$100 million are blocked. Funds enter Tornado Cash.
CoinDesk19 April 2026
Aave, SparkLend, and Fluid freeze rsETH collateral markets. Aave models $124M to $230M in potential bad debt. DeFi TVL begins a two-day drop of over $13 billion.
CoinDesk20 April 2026
Kelp DAO publicly disputes LayerZero's attribution of fault, claiming the 1-of-1 verifier setup reflected LayerZero's default documentation and quickstart guide recommendations.
CoinDesk22 April 2026
LayerZero attributes the exploit to North Korea's Lazarus Group (TraderTraitor subgroup) and announces cooperation with global law enforcement. Arbitrum Security Council freezes ~30,766 ETH linked to the exploit on Arbitrum One.
The Block10 May 2026
LayerZero issues a public apology, admits fault in the single-verifier architecture, and pledges 10,000 ETH to aid recovery. DeFi United consortium reportedly assembles over $300 million in pledges.
The Block13 May 2026
First recovery tranche of 25,000 rsETH transferred as part of the DeFi United recovery plan.
CoinTelegraph26 May 2026
Final recovery tranche of 20,373.7 rsETH transferred. Kelp DAO declares the operational phase of rsETH recovery complete. rsETH backing reportedly restored to 100%.
CoinTelegraphDecision Log
- hash: DEWrFRKQiv8jgqSyJSz7oVjE8gM4nypoboR7MCGCYGTA
- hash: 38QKfH3gSiS5df8u3TZqWzzdSp3zMQw85tvUGmTwSWZm
- hash: GmL9vQYgPBeH4mtQKttpfjWMrQkHGNnjRAbd5vyMyrof
This investigation is cryptographically anchored to the Solana blockchain (3 events). 22 of 24 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 7/27/2026, 5:08:47 PM
last updated: 8/26/2026, 6:06:25 AM
9 viewsavoid.net — verified advice for a post-truth world