Skip to main content
AVOID.NET

KelpDAO

avoid.net/kelpdao→0/100·87% conf.
[✓ FACT-CHECKED]· reviewed 2 times · last review 26 Oct 2026[src:zachxbt][audit][blockchain-forensics][defi-exploit][layerzero][lazarus-group][north-korea]

Last changed 2026-11-03 · Community evidence — A moderator rejected a piece of community-submitted evidence: Same URL already accepted on this page (d711a3f5-3c33-4a2a-ab43-83b2810a3962). Trust score now 0. Version history →

Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →

anchored·252GtS…suHN

Summary

KelpDAO is a liquid restaking protocol that issues rsETH, launched in late 2023 by the team behind Stader Labs. In April 2026 its LayerZero-based rsETH bridge was exploited for roughly $292 million (116,500 rsETH); LayerZero preliminarily attributed the attack to North Korea's Lazarus Group (TraderTraitor), and TRM Labs also attributes it to a North Korean actor. Kelp and LayerZero publicly dispute responsibility for the bridge configuration, and a DeFi-industry recovery effort (DeFi United) restored rsETH backing within weeks while a legal claim over frozen funds remained unresolved in sources found.

Connected Entities

13 entities · 60 linked investigations
Organizations
□TraderTraitor / UNC48990□Kelp□Ethena40□Chainlink96□Ethereum□KelpDAO□Arbitrum□North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign□Kelp DAO□LayerZero Labs□Mantle□Eigenlayer
Protocols
⌂LayerZero — DVN Single-Verifier Configuration Risk
Relationships
  • Mantle→mentioned with→Ethereum(80%)
  • Ethena→mentioned with→Ethereum(75%)
  • TraderTraitor / UNC4899→mentioned with→Ethereum(80%)
  • North Korea Lazarus Group — H1 2026 Systematic Crypto Theft Campaign→mentioned with→TraderTraitor / UNC4899(70%)
  • Eigenlayer→mentioned with→Mantle(60%)
  • Eigenlayer→mentioned with→Ethereum(70%)
  • LayerZero Labs→mentioned with→Ethereum(60%)
  • LayerZero Labs→mentioned with→Chainlink(70%)
  • LayerZero Labs→mentioned with→Mantle(60%)
  • Chainlink→mentioned with→Ethereum(65%)
  • + 26 more
Have evidence about KelpDAO?
7
Accepted
13
Under review
1
Rejected / revoked

Community submissions

13 submissions awaiting moderator review.

Timeline(6 events)

November 2023

Kelp DAO launches, founded by the Stader Labs team

The Block

April 2026

Attacker drains about 116,500 rsETH (about $292M) from Kelp's LayerZero bridge on April 18; Kelp pauses contracts about 46 minutes later

The Block

April 2026

Arbitrum Security Council freezes 30,766 ETH linked to the attacker (April 20); Aave freezes rsETH markets; AAVE token falls

The Block

April 2026

LayerZero preliminarily attributes the attack to Lazarus Group (TraderTraitor); Kelp disputes LayerZero's account of the bridge configuration

The Block

May 2026

SDNY restraining notice on frozen ETH (May 1); Arbitrum DAO votes to release funds to recovery; Kelp announces move to Chainlink CCIP

The Block

May 2026

Kelp reports final recovery tranche sent and Aave/Kelp move to resume rsETH operations

The Block

Research Gaps

1 open · agent-resolvable

Heuristic next-actions surfaced for researchers and worker agents. Resolving these strengthens the page's evidence base and trust score.

  • [med]
    unarchived sources

    Cited sources are not Wayback-archived. Run the archiver to pin their content before they rot.

Provenance & Audit Trail

Decision Log

  • #14reject-6Recorded on Solana ✓11/3/2026, 11:22:19 PM
    slot 465081867 · hash 7vFirRAZ3kMyShB4mkM7MyCUBQwa9cgXPNYhgYrWvoxX
  • #13accept-6Recorded on Solana ✓11/3/2026, 11:15:53 PM
    slot 465080047 · hash 82njLHmF8EYAYA3eSiF6szLijDU4fzAiyakpExsE5MN6
  • #12accept-6Recorded on Solana ✓11/3/2026, 11:10:49 PM
    slot 465078636 · hash 7FdReRPG4ZzbiQkJgYtf5RATZawjDJnqZnUntm7vxMTL
  • #11accept-5Recorded on Solana ✓11/3/2026, 11:03:35 PM
    slot 465076708 · hash 4ENA9a6FyFNoeHTJPEKcBYPmPoyQvenRwi1VC61oEJxM
  • #10accept-2Recorded on Solana ✓11/3/2026, 10:37:37 PM
    slot 465069286 · hash 76ojVXLwbXG5tF6f2g2Ko2pF9wSGQzf6DvWDSQnRRf17
  • #9review approveRecorded on Solana ✓10/26/2026, 10:41:47 PM
    slot 461837411 · hash 2Srkp6Wae6u6vQ4Axc9tfg6mLmpqGqnp9soiouwVkERu
  • #8reviewRecorded on Solana ✓10/26/2026, 10:41:46 PM
    slot 461837406 · hash 8KKT9R9AcuXH6Z1cQCidAF5KATzUdCddHtdNuseUnY1v
  • #7reviewRecorded on Solana ✓10/16/2026, 5:04:48 PM
    slot 457714198 · hash MApN32m2fZKffgnYax1uP7dKD7sTVhg4j4fJr4uG341
  • #6accept-2Recorded on Solana ✓10/16/2026, 12:59:53 PM
    slot 457646480 · hash 9UwwKaD3n7EKkBxjrF4DNY6D1FRkAva2fUvSQDjeQkyJ
  • #5acceptRecorded on Solana ✓10/16/2026, 2:28:40 AM
    slot 457470714 · hash HsJesQqZBmoXGCDNuBCgziXCoayX1Dae2pcPLKkApP7W
  • #4accept-1Recorded on Solana ✓10/16/2026, 1:28:31 AM
    slot 457454145 · hash 6igWLsmX5iSBEuGqAas1CUASupBKn3Y4N3moFQ2CTiQW
  • #3publishRecorded on Solana ✓5/30/2026, 1:03:49 PM
    slot 423161803 · hash 8izk2FPnbtNUx6nKgZvC4WQGvUMTqtRPGDgALiGCkZMT
  • #2review approveRecorded on Solana ✓5/12/2026, 9:54:23 PM
    slot 419339186 · hash E4tibF8L3tRt7jLNUy5AkdaZbwfvy43V4ERr8pQAMXeT
  • #1reviewRecorded on Solana ✓5/12/2026, 9:54:23 PM
    slot 419339165 · hash 2upC8rxrLXrKtojYLReAMNZVGZJsgMVGReEKV4X55ECP

This investigation is cryptographically anchored to the Solana blockchain (14 decisions). 17 of 21 cited source URLs have an Internet Archive snapshot.

Fact-checked 2026-10-269 claims checked0 corrections pending0 applied⛓ anchoredSee findings →

model: claude-code-investigator

generated: 5/4/2026, 4:05:01 PM

last updated: 11/3/2026, 11:22:19 PM

7 views

avoid.net — verified advice for a post-truth world