Audit log

Every state-changing event for Kelp DAO: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-27 17:09:02Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   GmL9vQYgPBeH…5vyMyrofcopysha256 → base58

   verifying row…

   canonical bytes (31184 B) ▸

   {"actor":"system:backfill","investigation_id":"70aa1b03-25c0-46a1-9a98-454053e9d96a","kind":"publish","page_slug":"kelp-dao","published_at":"2026-07-27T17:09:02.039Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Kelp DAO","sections":[{"content":"Kelp DAO is a liquid restaking protocol deployed on Ethereum and built on top of EigenLayer. Users deposit liquid staking tokens (LSTs) such as stETH and receive rsETH, an ERC-20 liquid restaking token (LRT) that earns both Ethereum staking rewards and EigenLayer restaking rewards simultaneously. The protocol launched in late 2023 and is operated by the same team behind Stader Labs, a multichain liquid staking platform with over $500 million in TVL at the time of Kelp's founding. In late 2024 the entity rebranded to KernelDAO, consolidating three product lines: Kelp (rsETH on Ethereum), Kernel (restaking infrastructure on BNB Chain), and Gain (yield vaults for crypto and real-world assets). At its peak prior to the April 2026 exploit, Kelp reported over $1.6 billion in TVL and more than 300,000 unique depositor addresses.","heading":"Protocol Overview","severity":"low","sources":[{"credibility":2,"name":"Nansen: What is Kelp DAO? The Ultimate Guide to Liquid Restaking","type":"research","url":"https://nansen.ai/post/what-is-kelp-dao"},{"credibility":2,"name":"Messari: What is Kelp DAO?","type":"research","url":"https://messari.io/project/kelp-dao/profile"},{"credibility":2,"name":"KuCoin Learn: What Is KernelDAO (KERNEL) Restaking Protocol?","type":"news_article","url":"https://www.kucoin.com/learn/crypto/what-is-kerneldao-kernel-restaking-protocol-and-how-does-it-work"}]},{"content":"Kelp DAO was co-founded by Amitej Gajjala and Dheeraj Borra, both of whom previously co-founded Stader Labs. Amitej studied at a top business school in India, worked in management consulting, and later served as head of strategy and transformation at Swiggy, India's largest food technology company, before entering crypto in 2019. Dheeraj holds a Bachelor's degree in Computer Science from IIT Kharagpur and a Master's degree from the University of Texas at Austin, with prior engineering roles at LinkedIn and Blend Labs focused on large-scale distributed systems. Stader Labs is both the incubator and a direct investor in Kelp DAO. Neither founder has disclosed a history of regulatory action or fraud allegations. The team has maintained public communication channels, including interviews with crypto media, and responded publicly to the April 2026 exploit.","heading":"Team and Background","severity":"low","sources":[{"credibility":2,"name":"ChainCatcher: Dialogue with Kelp DAO Founder","type":"news_article","url":"https://www.chaincatcher.com/en/article/2124305"},{"credibility":2,"name":"AiCoin: Exclusive Interview with Kelp DAO Founder","type":"news_article","url":"https://www.aicoin.com/en/article/403202"}]},{"content":"Kelp DAO closed a $9 million private token sale round in May 2024, at a reported valuation of approximately $90 million. The round was led by SCB Limited (a Bahamas-based proprietary trading firm) and Laser Digital (the crypto arm of Nomura Global), which contributed a combined $3.5 million. Additional participants included Bankless Ventures, Hypersphere Ventures, Draper Dragon, DACM, Cypher Capital, GSR, HTX Ventures, and DWF Ventures. No prior seed or Series A rounds with disclosed terms have been reported. The institutional backing from recognized names in the space lends credibility to the project's pre-exploit standing, though the involvement of DWF Ventures, a market maker with a contested reputation in the broader crypto community, is noted.","heading":"Funding and Investors","severity":"low","sources":[{"credibility":1,"name":"The Block: Ethereum liquid restaking platform Kelp raises token round at $90 million valuation","type":"news_article","url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation"},{"credibility":2,"name":"Yahoo Finance: Kelp DAO raises $9 million to boost DeFi and restaking platform","type":"news_article","url":"https://finance.yahoo.com/news/kelp-dao-raises-9-million-090008172.html"}]},{"content":"KernelDAO's native governance token, KERNEL, launched on April 14, 2025 following a publicly announced tokenomics structure. Total supply allocation: 55% to community rewards and airdrops (20% Season 1 airdrop, 35% future rewards), 20% to private sale investors, 20% to team and advisors, and 5% to ecosystem and partners. Team and private sale allocations are subject to a 6-month lock-up followed by a 24-month linear unlock. Season 1 airdrop eligibility was based on a December 31, 2024 snapshot; Season 2 ran from January 1 to April 30, 2025. The token carries governance utility, staking for economic security, and liquidity mining incentives. A minimum threshold of 150 Kelp Grand Miles was required per wallet to qualify for at least 100 KERNEL tokens. The allocation structure is broadly in line with industry norms, though the 20% team allocation and reliance on airdrop incentives for growth carry standard concentration and sell-pressure risks.","heading":"Tokenomics: KERNEL Token","severity":"medium","sources":[{"credibility":2,"name":"KernelDAO GitBook: KERNEL Tokenomics","type":"official","url":"https://kerneldao.gitbook.io/kernel/getting-started/usdkernel-tokenomics"},{"credibility":2,"name":"Gate News: KelpDAO announces KERNEL token economics","type":"news_article","url":"https://www.gate.com/news/detail/8280203"},{"credibility":2,"name":"PANews: Kelp DAO releases KERNEL token economics, 55% allocated to community rewards and airdrops","type":"news_article","url":"https://www.panewslab.com/en/articles/0zce3bxp"}]},{"content":"Prior to the April 2026 exploit, Kelp DAO's rsETH smart contracts had been audited by three security firms. Code4rena conducted a competitive audit from November 10-15, 2023, yielding 5 unique vulnerabilities: 3 rated HIGH and 2 rated MEDIUM. Known findings included an inflation attack vector and issues with mint amount calculations on deposit. SigmaPrime conducted a security assessment (version 2.0) that identified 9 issues in total. MixBytes completed a security audit published March 4, 2024. LlamaRisk's collateral risk assessment noted the absence of an active bug bounty program as a significant gap given the protocol's TVL, and flagged centralization risk through AWS Lambda functions managing critical operations via a single externally-owned account. The assessment also noted that governance remained centralized in the development team with multisig and a 10-day timelock, lacking a formal DAO structure at the time of assessment. Critically, the April 2026 exploit did not originate in the audited smart contracts themselves but in the configuration of the LayerZero cross-chain bridge infrastructure, a surface that fell outside the scope of the existing audits.","heading":"Smart Contract Audits","severity":"high","sources":[{"credibility":1,"name":"Code4rena: Kelp DAO rsETH Audit Report","type":"research","url":"https://code4rena.com/reports/2023-11-kelp"},{"credibility":1,"name":"SigmaPrime: KELP DAO LRT Smart Contract Security Assessment v2.0","type":"research","url":"https://kerneldao.com/kelp/audits/smartcontracts/SigmaPrime_2.pdf"},{"credibility":1,"name":"MixBytes: KELPDAO LRT-ETH Security Audit Report March 2024","type":"research","url":"https://kelpdao.xyz/audits/smartcontracts/mixbytes.pdf"},{"credibility":2,"name":"LlamaRisk: Collateral Risk Assessment - Kelp DAO Restaked ETH","type":"research","url":"https://www.llamarisk.com/research/collateral-risk-rseth"},{"credibility":2,"name":"Cyberscope: Kelp DAO Restaked ETH Smart Contract Audit","type":"research","url":"https://www.cyberscope.io/audits/coin-kelp-dao-restaked-eth"}]},{"content":"On April 18, 2026 at 17:35 UTC, Kelp DAO's cross-chain bridge, powered by LayerZero's Decentralized Verifier Network (DVN), was exploited for approximately 116,500 rsETH tokens valued at roughly $292 million — approximately 18% of rsETH's circulating supply of 630,000 tokens. This became the largest single DeFi exploit of 2026 at the time of occurrence. The root cause was a 1-of-1 verifier configuration: only a single node was responsible for validating cross-chain messages before authorizing the release of funds. Attackers attributed to North Korea's Lazarus Group (TraderTraitor subgroup) compromised two RPC nodes used by the DVN, then launched a coordinated DDoS attack against the remaining legitimate nodes to force a failover to the poisoned infrastructure. This allowed the attackers to feed fraudulent cross-chain messages to the isolated verifier, which then authorized the release of funds against a non-existent burn event on the source chain. Kelp's emergency multisig froze core contracts 46 minutes after the initial drain at 18:21 UTC, blocking two subsequent drain attempts totaling an estimated $100 million. Funds entered Tornado Cash, obscuring the on-chain trail. LayerZero initially attributed the exploit to Kelp's configuration choices, claiming the 1-of-1 setup was deployed against guidance. Kelp DAO publicly disputed this, pointing to LayerZero's own documentation and developer quickstart guides as evidence that the single-verifier setup reflected the platform's default onboarding recommendations. Approximately three weeks after the exploit, LayerZero issued a public apology and admitted fault in the single-verifier architecture, and pledged 10,000 ETH (split as a 5,000 ETH donation and 5,000 ETH loan to Aave) to aid recovery. An open-source security audit tool had flagged opacity in Kelp's DVN configuration 12 days before the exploit, identifying that the configuration was not publicly disclosed, though it did not specifically characterize the configuration as 1-of-1.","heading":"April 2026 Bridge Exploit ($292 Million)","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: 2026's Biggest Crypto Exploit — Kelp DAO Hit for $292 Million","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"credibility":2,"name":"Halborn: Explained — The Kelp DAO Hack (April 2026)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026"},{"credibility":1,"name":"Chainalysis: Inside the KelpDAO Bridge Exploit","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":1,"name":"The Block: Kelp DAO shifts blame to LayerZero for $292 million exploit","type":"news_article","url":"https://www.theblock.co/post/398204/kelp-dao-shifts-blame-layerzero"},{"credibility":1,"name":"The Block: LayerZero issues public apology, admits fault in single-verifier setup","type":"news_article","url":"https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup"},{"credibility":1,"name":"SecurityWeek: $290 Million Kelp DAO Crypto Heist Blamed on North Korea","type":"news_article","url":"https://www.securityweek.com/290-million-kelp-dao-crypto-heist-blamed-on-north-korea/"},{"credibility":2,"name":"DEXTools: Kelp DAO hit by $293M hack — biggest DeFi theft of 2026","type":"news_article","url":"https://www.dextools.io/news/kelp-dao-hit-by-293m-hack-biggest-defi-theft-of-2026"}]},{"content":"The exploit triggered systemic contagion across DeFi. Within hours, Aave, SparkLend, and Fluid froze rsETH collateral markets. Aave modeled potential bad debt scenarios ranging from $124 million (if losses were spread across all rsETH holders via a ~15% depeg) to $230 million (if losses were isolated to Layer 2 networks such as Arbitrum and Mantle). Aave's TVL fell from approximately $26.4 billion to approximately $18 billion in the immediate aftermath, a drop of roughly $8 billion. Total DeFi TVL declined by an estimated $13 billion over two days following the exploit. The Arbitrum Security Council took emergency action to freeze approximately 30,766 ETH held in exploit-linked addresses on Arbitrum One. The Arbitrum DAO subsequently approved a $70 million ETH release to aid the broader recovery effort.","heading":"Systemic Contagion: Aave and DeFi Impact","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: Aave could face up to $230m in losses after Kelp DAO bridge exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos"},{"credibility":1,"name":"CoinDesk: DeFi TVL drops more than $13 billion in two days following Kelp DAO hack","type":"news_article","url":"https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack"},{"credibility":1,"name":"CoinDesk: Aave records $6 billion TVL drop as Kelp hack exposes structural risk","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/19/aave-records-usd6-billion-tvl-drop-as-kelp-hack-exposes-structural-risk-at-defi-lender"},{"credibility":2,"name":"The Defiant: Aave Models $124M to $230M in Bad Debt From Kelp Exploit","type":"news_article","url":"https://thedefiant.io/news/hacks/aave-models-usd124m-to-usd230m-in-bad-debt-from-kelp-exploit-layerzero-and-kelp-continue-to"}]},{"content":"Following the exploit, Kelp DAO coordinated a recovery effort under the banner of DeFi United, a consortium of DeFi protocols that collectively pledged over $300 million in ETH and stablecoins to restore rsETH's full backing. LayerZero contributed 10,000 ETH. Arbitrum DAO approved a $70 million ETH release. On May 13, 2026, the first tranche of 25,000 rsETH was transferred as part of the recovery plan; the final 20,373.7 rsETH tokens were sent on May 26, 2026, completing what Kelp described as the operational phase of recovery. Kelp DAO stated that rsETH mints, redemptions, and rewards operations returned to normal function after withdrawals were reopened. As of the reporting date, rsETH backing has reportedly been restored to 100%. However, individual user compensation for losses incurred during the depeg period has not been publicly detailed, and Aave's TVL has not recovered to pre-exploit levels, hovering significantly below the $20 billion mark.","heading":"Recovery and DeFi United Initiative","severity":"high","sources":[{"credibility":1,"name":"CoinTelegraph: Kelp DAO says rsETH restored 5 weeks after $293M protocol hack","type":"news_article","url":"https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack"},{"credibility":2,"name":"Cryptopolitan: LayerZero pledges $23M to DeFi United after $292M Kelp DAO exploit fallout","type":"news_article","url":"https://www.cryptopolitan.com/layerzero-pledges-23m-to-defi-united/"},{"credibility":2,"name":"Blockchain.news: Kelp DAO and Aave Advance rsETH Recovery After $293M Hack","type":"news_article","url":"https://blockchain.news/news/kelp-dao-aave-rseth-recovery"}]},{"content":"LayerZero, collaborating with global law enforcement, attributed the April 2026 exploit to North Korea's Lazarus Group, specifically the TraderTraitor operational subgroup. The attribution is characterized as likely but not confirmed. The Lazarus Group has been linked to several of the largest crypto thefts on record, including the $625 million Ronin Network hack in 2022 and the $285 million Drift protocol hack on April 1, 2026 — just 18 days before the Kelp DAO exploit. U.S. Treasury and United Nations assessments have documented Lazarus's use of crypto theft to fund North Korea's weapons programs. Stolen funds reportedly entered Tornado Cash, a privacy mixer, obscuring further on-chain tracing. No law enforcement charges or asset seizures directly connected to the Kelp DAO hack had been publicly announced as of the investigation date.","heading":"Threat Attribution: North Korea Lazarus Group","severity":"critical","sources":[{"credibility":2,"name":"Unchained Crypto: LayerZero Links $292 Million Kelp DAO Bridge Exploit to North Korea's Lazarus Group","type":"news_article","url":"https://unchainedcrypto.com/layerzero-links-292-million-kelp-dao-bridge-exploit-to-north-koreas-lazarus-group/"},{"credibility":1,"name":"The Block: LayerZero says North Korea's Lazarus likely behind Kelp DAO exploit; blames single-point setup","type":"news_article","url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus"},{"credibility":1,"name":"SC Media: Major Kelp DAO cross-chain bridge theft attributed to North Korean hackers","type":"news_article","url":"https://www.scworld.com/brief/major-kelp-dao-cross-chain-bridge-theft-attributed-to-north-korean-hackers"},{"credibility":1,"name":"UPI: North Korean hackers tied to $290M crypto heist, firm says","type":"news_article","url":"https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/"}]},{"content":"Several structural risk factors remain relevant to evaluating Kelp DAO post-recovery. First, EigenLayer slashing risk: rsETH is exposed to slashing by EigenLayer's actively validated services (AVSs) for operator misbehavior; if an operator delegated by Kelp is slashed, all rsETH holders proportionally bear the loss. The EigenLayer AVS ecosystem was still maturing at the time of this investigation. Second, centralization of governance: LlamaRisk's assessment found governance remained concentrated in the development team, with contract upgrade authority held through multisig wallets and a 10-day timelock but without a fully operational on-chain DAO. Third, off-chain infrastructure risk: AWS Lambda functions managing critical operations through a single externally-owned account represent a non-smart-contract attack surface that falls outside standard audit scope — a category of risk that the April 2026 exploit demonstrated is not hypothetical. Fourth, cross-chain bridge risk: the 2026 exploit exposed the systemic danger of a 1-of-1 verifier setup in cross-chain infrastructure; whether Kelp's post-exploit bridge configuration has been independently audited and verified as multi-verifier is not confirmed in available public sources as of this investigation. Fifth, no regulatory action has been identified against Kelp DAO, KernelDAO, or their founders by the SEC, CFTC, OFAC, or other agencies.","heading":"Structural and Ongoing Risk Factors","severity":"high","sources":[{"credibility":2,"name":"LlamaRisk: Collateral Risk Assessment — Kelp DAO Restaked ETH","type":"research","url":"https://www.llamarisk.com/research/collateral-risk-rseth"},{"credibility":1,"name":"CoinDesk: The $292 million Kelp DAO exploit shows why crypto bridges are still the industry's weakest links","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/21/the-usd292-million-kelp-dao-exploit-shows-why-crypto-bridges-are-still-one-of-the-industry-s-weakest-links"},{"credibility":2,"name":"CORE3 Blog: Crypto Risk in 2026 — Why 75% of Web3 Exploits Happen Outside Smart Contract Audits","type":"research","url":"https://core3.io/blog/Learn/crypto-risk-in-2026-why-75-of-web3-exploits-happen-outside-smart-contract-audits"}]},{"content":"Prior to the April 2026 exploit, Kelp DAO maintained a broadly positive reputation in the DeFi restaking sector, having attracted over 300,000 unique depositor addresses and integrations with more than 120 DeFi platforms. The KERNEL token launch proceeded without reported controversy. Following the exploit, community sentiment shifted significantly. Social media commentary characterized the incident as evidence of deep structural flaws in DeFi cross-chain infrastructure. The public dispute between Kelp DAO and LayerZero over responsibility attracted substantial attention, with both parties issuing competing narratives before LayerZero eventually acknowledged fault. The DeFi United recovery effort, while ultimately successful in restoring rsETH backing, did not appear to include direct user compensation for losses incurred during the depeg window. As of mid-2026, the broader DeFi community has cited the Kelp DAO exploit as a catalyst for new industry standards around cross-chain verifier configuration.","heading":"Community and Reputation","severity":"medium","sources":[{"credibility":1,"name":"CoinDesk: DeFi is dead — crypto community scrambles after $292M hack exposes cross-chain risks","type":"news_article","url":"https://www.coindesk.com/news-analysis/2026/04/19/defi-is-dead-crypto-community-scrambles-after-usd292-million-hack-exposes-cross-chain-risks"},{"credibility":1,"name":"CoinDesk: The $293M KelpDAO hack shows why DeFi is finally being forced to grow up","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up"},{"credibility":3,"name":"KernelDAO on X: KERNEL Season 1 Airdrop announcement","type":"social_media","url":"https://x.com/kernel_dao/status/1904569248036634914"}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: 2026's Biggest Crypto Exploit — Kelp DAO Hit for $292 Million","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"credibility":1,"name":"Chainalysis: Inside the KelpDAO Bridge Exploit","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":1,"name":"The Block: LayerZero says North Korea's Lazarus likely behind Kelp DAO exploit","type":"news_article","url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus"},{"credibility":1,"name":"The Block: LayerZero issues public apology, admits fault in single-verifier setup","type":"news_article","url":"https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup"},{"credibility":1,"name":"The Block: Kelp DAO shifts blame to LayerZero for $292 million exploit","type":"news_article","url":"https://www.theblock.co/post/398204/kelp-dao-shifts-blame-layerzero"},{"credibility":1,"name":"The Block: Ethereum liquid restaking platform Kelp raises token round at $90 million valuation","type":"news_article","url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation"},{"credibility":2,"name":"Halborn: Explained — The Kelp DAO Hack (April 2026)","type":"research","url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026"},{"credibility":1,"name":"SecurityWeek: $290 Million Kelp DAO Crypto Heist Blamed on North Korea","type":"news_article","url":"https://www.securityweek.com/290-million-kelp-dao-crypto-heist-blamed-on-north-korea/"},{"credibility":1,"name":"SC Media: Major Kelp DAO cross-chain bridge theft attributed to North Korean hackers","type":"news_article","url":"https://www.scworld.com/brief/major-kelp-dao-cross-chain-bridge-theft-attributed-to-north-korean-hackers"},{"credibility":1,"name":"UPI: North Korean hackers tied to $290M crypto heist","type":"news_article","url":"https://www.upi.com/Top_News/World-News/2026/04/22/KelpDAO-LayerZero-North-Korea-crypto-hack-theft-Lazarus-Group/6151776848419/"},{"credibility":1,"name":"CoinDesk: Aave could face up to $230m in losses after Kelp DAO bridge exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos"},{"credibility":1,"name":"CoinDesk: DeFi TVL drops more than $13 billion in two days following Kelp DAO hack","type":"news_article","url":"https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack"},{"credibility":1,"name":"CoinTelegraph: Kelp DAO says rsETH restored 5 weeks after $293M protocol hack","type":"news_article","url":"https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack"},{"credibility":2,"name":"LlamaRisk: Collateral Risk Assessment — Kelp DAO Restaked ETH","type":"research","url":"https://www.llamarisk.com/research/collateral-risk-rseth"},{"credibility":1,"name":"Code4rena: Kelp DAO rsETH Audit Report","type":"research","url":"https://code4rena.com/reports/2023-11-kelp"},{"credibility":1,"name":"SigmaPrime: KELP DAO LRT Smart Contract Security Assessment v2.0","type":"research","url":"https://kerneldao.com/kelp/audits/smartcontracts/SigmaPrime_2.pdf"},{"credibility":1,"name":"MixBytes: KELPDAO LRT-ETH Security Audit Report March 2024","type":"research","url":"https://kelpdao.xyz/audits/smartcontracts/mixbytes.pdf"},{"credibility":2,"name":"Nansen: What is Kelp DAO?","type":"research","url":"https://nansen.ai/post/what-is-kelp-dao"},{"credibility":2,"name":"Messari: What is Kelp DAO?","type":"research","url":"https://messari.io/project/kelp-dao/profile"},{"credibility":2,"name":"KernelDAO GitBook: KERNEL Tokenomics","type":"official","url":"https://kerneldao.gitbook.io/kernel/getting-started/usdkernel-tokenomics"},{"credibility":2,"name":"Yahoo Finance: Kelp DAO raises $9 million","type":"news_article","url":"https://finance.yahoo.com/news/kelp-dao-raises-9-million-090008172.html"},{"credibility":1,"name":"CoinDesk: The $293M KelpDAO hack shows why DeFi is finally being forced to grow up","type":"news_article","url":"https://www.coindesk.com/tech/2026/05/16/the-usd293-million-kelpdao-hack-shows-why-defi-is-finally-being-forced-to-grow-up"},{"credibility":2,"name":"PANews: Open-source AI tool flagged vulnerability 12 days before $292M Kelp DAO hack","type":"news_article","url":"https://www.panewslab.com/en/articles/019da9ba-cfc3-75a8-b5a1-f8475f5a37f3"},{"credibility":1,"name":"CoinDesk: The $292 million Kelp DAO exploit shows why crypto bridges are still the industry's weakest links","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/21/the-usd292-million-kelp-dao-exploit-shows-why-crypto-bridges-are-still-one-of-the-industry-s-weakest-links"}],"summary":"Kelp DAO is a liquid restaking protocol built on EigenLayer that issues rsETH, a non-rebasing liquid restaking token. Originally incubated by Stader Labs and later rebranded to KernelDAO, the protocol grew to over $1.6 billion in TVL before suffering the largest single DeFi exploit of 2026: a $292 million cross-chain bridge attack attributed to North Korea's Lazarus Group. The protocol completed an operational rsETH recovery approximately five weeks after the hack through the DeFi United initiative, but significant reputational, systemic, and structural questions remain.","timeline":[{"date":"2023-11-10","event":"Code4rena competitive audit of rsETH smart contracts begins; concludes November 15, 2023. Five vulnerabilities found: 3 HIGH, 2 MEDIUM.","source":"Code4rena Audit Report","source_url":"https://code4rena.com/reports/2023-11-kelp"},{"date":"2024-03-04","event":"MixBytes publishes security audit of Kelp DAO LRT-ETH smart contracts.","source":"MixBytes Audit Report","source_url":"https://kelpdao.xyz/audits/smartcontracts/mixbytes.pdf"},{"date":"2024-02-21","event":"Kelp DAO introduces the KEP token, making EigenLayer points liquid and tradeable for rsETH holders.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2024/02/21/restaking-protocol-kelp-dao-brings-liquidity-to-eigenlayer-points"},{"date":"2024-05-22","event":"Kelp DAO closes a $9 million private token sale at a $90 million valuation. Investors include SCB Limited, Laser Digital, Hypersphere Ventures, DWF Ventures, and others.","source":"The Block","source_url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation"},{"date":"2024-12-31","event":"Snapshot date for KERNEL Season 1 airdrop eligibility. Kelp DAO announces rebranding to KernelDAO.","source":"KernelDAO GitBook Tokenomics","source_url":"https://kerneldao.gitbook.io/kernel/getting-started/usdkernel-tokenomics"},{"date":"2025-04-14","event":"KERNEL token generation event (TGE). Token launches with governance, staking, and liquidity mining utilities.","source":"Gate News","source_url":"https://www.gate.com/news/detail/8280203"},{"date":"2026-04-06","event":"An open-source security audit tool allegedly flags opacity in Kelp DAO's DVN configuration, noting it is not publicly disclosed. The warning is not acted upon.","source":"PANews","source_url":"https://www.panewslab.com/en/articles/019da9ba-cfc3-75a8-b5a1-f8475f5a37f3"},{"date":"2026-04-18","event":"At 17:35 UTC, attackers exploit Kelp DAO's LayerZero cross-chain bridge via a 1-of-1 DVN configuration, draining 116,500 rsETH (~$292 million). Kelp's emergency multisig freezes core contracts 46 minutes later at 18:21 UTC. Two subsequent drain attempts totaling ~$100 million are blocked. Funds enter Tornado Cash.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04-19","event":"Aave, SparkLend, and Fluid freeze rsETH collateral markets. Aave models $124M to $230M in potential bad debt. DeFi TVL begins a two-day drop of over $13 billion.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos"},{"date":"2026-04-20","event":"Kelp DAO publicly disputes LayerZero's attribution of fault, claiming the 1-of-1 verifier setup reflected LayerZero's default documentation and quickstart guide recommendations.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster"},{"date":"2026-04-22","event":"LayerZero attributes the exploit to North Korea's Lazarus Group (TraderTraitor subgroup) and announces cooperation with global law enforcement. Arbitrum Security Council freezes ~30,766 ETH linked to the exploit on Arbitrum One.","source":"The Block","source_url":"https://www.theblock.co/post/398028/layerzero-kelp-dao-lazarus"},{"date":"2026-05-10","event":"LayerZero issues a public apology, admits fault in the single-verifier architecture, and pledges 10,000 ETH to aid recovery. DeFi United consortium reportedly assembles over $300 million in pledges.","source":"The Block","source_url":"https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup"},{"date":"2026-05-13","event":"First recovery tranche of 25,000 rsETH transferred as part of the DeFi United recovery plan.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack"},{"date":"2026-05-26","event":"Final recovery tranche of 20,373.7 rsETH transferred. Kelp DAO declares the operational phase of rsETH recovery complete. rsETH backing reportedly restored to 100%.","source":"CoinTelegraph","source_url":"https://cointelegraph.com/news/kelpdao-says-rseth-restored-5-weeks-after-protocol-hack"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision bd6725da-0bd7-49f3-a301-008af8dd3470copy