Audit log

Every state-changing event for KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-07-29 12:06:16Z
   Score: ? → ? (no score change)
   anchorpending

   chain

   ●—

   hash

   77vhe71SUc1V…M7dUkDoPcopysha256 → base58

   verifying row…

   canonical bytes (34875 B) ▸

   {"actor":"system:backfill","investigation_id":"30fb1b89-f9c9-4690-8e88-091075aef49e","kind":"publish","page_slug":"kelpdao-layerzero-bridge-exploit-april-2026-dprk-lazarus","published_at":"2026-07-29T12:06:16.355Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus","sections":[{"content":"At approximately 17:35 UTC on Saturday, April 18, 2026, an attacker drained 116,500 rsETH (approximately $292 million) from KelpDAO's LayerZero Omnichain Fungible Token (OFT) bridge — the single largest DeFi exploit of 2026. The attack did not target a smart contract flaw but rather off-chain infrastructure: attackers compromised two internal RPC nodes used by LayerZero Labs' Decentralized Verifier Node (DVN), swapping out the node software to report false blockchain state. They simultaneously launched a distributed denial-of-service (DDoS) attack against remaining external RPC nodes to force the DVN's failover to the poisoned internal nodes. The compromised nodes falsely reported that rsETH had been burned on the source chain when no such burn occurred, causing the Ethereum bridge contract to release funds to an attacker-controlled address. The attacker came within three minutes of stealing an additional $95–100 million before KelpDAO's emergency pauser multisig froze the protocol's core contracts at 18:21 UTC — 46 minutes after the initial drain. Two follow-up attack attempts at 18:26 and 18:28 UTC reverted without success. KelpDAO publicly acknowledged the incident on social media at approximately 20:10 UTC, nearly three hours after the initial drain. The breach had been preceded by a social engineering campaign beginning March 6, 2026, in which attackers harvested session keys from a LayerZero Labs developer, enabling them to pivot into LayerZero's RPC cloud environment and plant the poisoned nodes.","heading":"Attack Overview and Timeline","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: 2026's Biggest Crypto Exploit — Kelp DAO Hit for $292 Million","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"credibility":1,"name":"CoinDesk: LayerZero Blames Kelp's Setup for $290 Million Exploit, Attributes It to North Korea's Lazarus","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"credibility":2,"name":"Chainalysis: Inside the KelpDAO Bridge Exploit","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"}]},{"content":"The exploit's root cause centered on KelpDAO's use of a 1-of-1 DVN configuration — a setup in which LayerZero Labs was the sole entity verifying cross-chain messages for the bridge. A single verifier meant that compromising LayerZero's DVN infrastructure was sufficient to forge an approved cross-chain message with no redundant check. LayerZero's initial April 19, 2026 postmortem stated the incident resulted from 'Kelp's security choices rather than LayerZero's code' and that the 1-of-1 DVN configuration 'directly contradicts' its recommended multi-DVN security model. However, KelpDAO published a counter-memo titled 'Setting the Record Straight Around the LayerZero Bridge Hack' on or around May 5, 2026, citing Telegram screenshots in which a LayerZero team member had stated 'No problem on using defaults either' regarding the verifier configuration. KelpDAO also claimed that LayerZero personnel reviewed and approved the setup across 2.5 years and eight integration discussions. A security researcher from Spearbit, Sujith Somraaj, alleged he had submitted a bug bounty describing this exact attack pattern, which LayerZero rejected. Data at the time of the hack showed that approximately 47% of the roughly 2,665 active LayerZero OApps were using 1-of-1 DVN configurations, representing over $4.5 billion in exposed value. On or around May 10, 2026, LayerZero published an updated statement acknowledging: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions' and 'We own that,' reversing its earlier position that sole responsibility lay with KelpDAO. LayerZero subsequently announced it would no longer sign messages for any application running a 1-of-1 configuration and began migrating defaults to a 5/5 multi-DVN setup, with a floor of 3/3 on chains where fewer DVNs are available.","heading":"DVN Configuration and the 1-of-1 Single Point of Failure","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: Kelp Claims That LayerZero Approved the Setup It Blamed for $292 Million Bridge Hack","type":"news_article","url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"credibility":2,"name":"CryptoTimes: LayerZero Says 'We Own That' After $292M Kelp DAO Hack, Admits Security Mistake","type":"news_article","url":"https://www.cryptotimes.io/2026/05/10/layerzero-says-we-own-that-after-292m-kelp-dao-hack-admits-security-mistake/"},{"credibility":1,"name":"CoinDesk: Kelp DAO Hits Back at LayerZero for Trying to Shift the Blame","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster"},{"credibility":2,"name":"Unchained Crypto: Kelp DAO Disputes LayerZero's Account of the $290 Million Exploit","type":"news_article","url":"https://unchainedcrypto.com/kelp-dao-disputes-layerzeros-account-of-the-290-million-exploit-escalating-blame-game/"},{"credibility":1,"name":"LayerZero: KelpDAO Incident Statement (official blog)","type":"official","url":"https://layerzero.network/blog/kelpdao-incident-statement"},{"credibility":1,"name":"LayerZero: LayerZero Labs KelpDAO Incident Report (official blog)","type":"official","url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report"}]},{"content":"LayerZero attributed the attack with preliminary confidence to North Korea's Lazarus Group, specifically its TraderTraitor subunit. TRM Labs corroborated this attribution in a report published after the event, tracing a portion of the exploit's initial funding as far back as 2018 to a Bitcoin wallet controlled by Wu Huihui, a Chinese crypto broker indicted in 2023 for laundering Lazarus Group theft proceeds; the funding chain also connected to BTCTurk hack proceeds, reinforcing the Lazarus attribution. Security firm Cyvers declined to make the same attribution, noting that while certain operational patterns matched DPRK operations, no definitive wallet clustering had confirmed the connection as of publication. TRM Labs reported that this single attack, combined with the April 1, 2026 Drift Protocol hack ($285 million), meant North Korea was responsible for approximately $577 million in stolen crypto through April 2026 — 76% of all global crypto hack losses in H1 2026 across a total loss pool of approximately $759 million, achieved via just two attacks. TRM Labs noted that cumulative attributed crypto theft by North Korea since 2017 exceeded $6 billion following these events. North Korea publicly denied the TRM Labs attribution data.","heading":"Attribution — Lazarus Group / TraderTraitor (DPRK)","severity":"critical","sources":[{"credibility":1,"name":"TRM Labs: North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks","type":"research","url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks"},{"credibility":2,"name":"Decrypt: LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group","type":"news_article","url":"https://decrypt.co/364872/layerzero-pins-292m-kelpdao-bridge-hack-on-north-koreas-lazarus-group"},{"credibility":2,"name":"BeInCrypto: LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor","type":"news_article","url":"https://beincrypto.com/layerzero-kelpdao-hack-lazarus-north-korea/"},{"credibility":2,"name":"Crypto.news: North Korea Denies TRM Labs Data Tying It to Major Crypto Hacks","type":"news_article","url":"https://crypto.news/north-korea-denies-trm-labs-data-tying-it-to-major-crypto-hacks/"},{"credibility":1,"name":"CoinDesk: North Korean Hackers Are Moving Faster — They Account for 76% of Crypto Exploits This Year","type":"news_article","url":"https://www.coindesk.com/business/2026/04/30/north-korean-hackers-are-moving-faster-they-account-for-76-of-crypto-exploits-this-year-trmlabs"}]},{"content":"Following the theft of 116,500 rsETH, the attacker supplied a substantial portion of the stolen tokens as collateral on Aave V3, borrowing approximately 126,000 WETH (worth approximately $236 million at the time), effectively creating a large undercollateralized position. Aave froze rsETH markets shortly after the exploit; SparkLend and Fluid also paused rsETH markets. Aave modeled its potential bad debt exposure at between $124 million and $230 million, depending on how KelpDAO chose to distribute losses: if spread across all rsETH holders, rsETH would face an estimated 15% depeg resulting in approximately $124 million in bad debt; if losses were isolated to Layer 2 networks, bad debt could reach approximately $230 million. Some sources cited the final bad debt figure as approximately $177 million. The broader DeFi market reacted with alarm; reports cited over $10 billion in withdrawals from Aave as participants panicked. Aave founder Stani Kulechov confirmed that Aave's own contracts were not compromised and that the exploit was external.","heading":"Downstream Contagion — Aave Bad Debt and DeFi Panic","severity":"critical","sources":[{"credibility":1,"name":"CoinDesk: Aave Could Face Up to $230 Million in Losses After Kelp DAO Bridge Exploit Triggers DeFi Chaos","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos"},{"credibility":2,"name":"The Block: Kelp DAO Shifts Blame to LayerZero for $292 Million Exploit; Aave Examines Bad Debt Scenarios","type":"news_article","url":"https://www.theblock.co/post/398204/kelp-dao-shifts-blame-layerzero"},{"credibility":2,"name":"The Defiant: Aave Models $124M to $230M in Bad Debt From Kelp Exploit","type":"news_article","url":"https://thedefiant.io/news/hacks/aave-models-usd124m-to-usd230m-in-bad-debt-from-kelp-exploit-layerzero-and-kelp-continue-to"},{"credibility":3,"name":"KuCoin: KelpDAO rsETH Exploit — How the $292M LayerZero Bridge Attack Created $177M Bad Debt on Aave","type":"news_article","url":"https://www.kucoin.com/blog/my-kelpdao-rseth-exploit-how-292m-layerzero-bridge-attack-created-177m-bad-debt-on-aave"}]},{"content":"On April 21, 2026, the exploiter began moving approximately 75,701 ETH (roughly $175 million) across three transactions into freshly created Ethereum mainnet addresses. THORChain emerged as the primary laundering infrastructure; the exploiter allegedly routed approximately $80 million in ETH through THORChain within days of the attack, converting ETH to Bitcoin. TRM Labs reported that THORChain had 'processed the vast majority of proceeds from both the Bybit breach (2025) and the KelpDAO hack (2026), converting hundreds of millions in stolen ETH to Bitcoin.' Some security analysts also cited suspected routing through Tornado Cash, though THORChain was the dominant exit venue. One source estimated that approximately $1.2 billion — 85% of stolen funds from North Korea's two H1 2026 attacks combined — flowed through THORChain. The Arbitrum Security Council froze 30,766 ETH (approximately $71 million) on April 20, 2026, moving the assets to an intermediary wallet accessible only through further Arbitrum governance action; this recovery represented approximately one-quarter of the stolen assets. After the freeze, the exploiter accelerated laundering of the remaining funds through THORChain. Approximately $75 million of the total stolen amount had been frozen across Arbitrum as a result of coordinated action with law enforcement.","heading":"Fund Movement and Laundering Infrastructure","severity":"high","sources":[{"credibility":2,"name":"Unchained Crypto: Kelp DAO Exploiter Moves $175 Million in Stolen ETH Into New Wallets, Routing Funds Through THORChain","type":"news_article","url":"https://unchainedcrypto.com/kelp-dao-exploiter-moves-175-million-in-stolen-eth-into-new-wallets-routing-funds-through-thorchain/"},{"credibility":1,"name":"CoinDesk: Arbitrum Freezes $71 Million in Ether Tied to Kelp DAO Exploit","type":"news_article","url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit"},{"credibility":2,"name":"The Block: Kelp DAO Exploiter Begins Moving Stolen Funds Across Chains After Arbitrum ETH Freeze","type":"news_article","url":"https://www.theblock.co/post/398239/kelp-dao-exploiter-begins-moving-stolen-funds-across-chains-after-arbitrum-eth-freeze"},{"credibility":1,"name":"TRM Labs: North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks","type":"research","url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks"},{"credibility":2,"name":"Yahoo Finance / CryptoTimes: THORChain Volume Surges 18x as KelpDAO Hacker Routes $80M in ETH to Bitcoin","type":"news_article","url":"https://www.cryptotimes.io/2026/04/22/thorchain-volume-surges-18x-as-kelpdao-hacker-routes-80m-in-eth-to-bitcoin/"},{"credibility":2,"name":"CryptoBriefing: Lazarus Group Exploits THORChain for $292M rsETH Laundering Operation","type":"news_article","url":"https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/"}]},{"content":"On May 1, 2026, the U.S. District Court for the Southern District of New York issued a temporary restraining order freezing approximately 30,766 ETH (worth approximately $71.1 million) — the same assets already frozen by Arbitrum's Security Council — following a legal claim by families holding unpaid terrorism judgments against North Korea. The plaintiffs, including Han Kim and Yong Seok Kim, are U.S. nationals whose relative was killed by the North Korean government; they hold terrorism judgments against the DPRK exceeding $877 million (excluding interest), including a judgment exceeding $300 million from a 2015 court case. Their legal theory rested on the Foreign Sovereign Immunities Act and the Terrorism Risk Insurance Act, characterizing the frozen ETH as property belonging to North Korea given LayerZero's attribution of the hack to the Lazarus Group. The Arbitrum freeze and subsequent U.S. court action represent one of the first instances of a U.S. court seeking to attach cryptocurrency assets frozen by a blockchain governance body in connection with a state-sponsored hack. The freeze was reported to have complicated the broader DeFi United recovery effort, as the frozen assets were simultaneously subject to competing claims.","heading":"Legal and Regulatory Response","severity":"high","sources":[{"credibility":1,"name":"Unchained Crypto: U.S. Court Freezes $71 Million in Kelp DAO ETH After North Korea Terrorism Creditors File Claim","type":"court_filing","url":"https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/"},{"credibility":1,"name":"CoinDesk: Inside the $71 Million Freeze on Arbitrum That Has the Crypto World Questioning What Decentralization Really Means","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/22/inside-the-usd71-million-freeze-on-arbitrum-that-has-the-crypto-world-questioning-what-decentralization-really-means"},{"credibility":2,"name":"Yahoo Finance: Arbitrum's KelpDAO Freeze Backfires as US Court Blocks $71 Million Recovery","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/arbitrum-kelpdao-freeze-backfires-us-160122096.html"}]},{"content":"Aave service providers organized a coordinated relief initiative called DeFi United in the days following the exploit, aimed at fully restoring the backing of rsETH and preventing bad debt from impacting Aave lenders. The coalition gathered over $300 million in pledges (roughly 130,000 ETH and equivalents) from major DeFi participants. Contributors included Mantle (30,000 ETH via credit facility), Aave DAO (25,000 ETH pending governance vote), Stani Kulechov personally (5,000 ETH), Ether.fi (5,000 ETH), Lido Finance (2,500 stETH), Kelp DAO (2,000 ETH), Golem Foundation (1,000 ETH), and the Arbitrum Security Council's frozen 30,766 ETH. LayerZero separately pledged $23 million to DeFi United following its later partial admission of fault. As of late April 2026, the effort had gathered over $238 million in committed or contributed assets and was ongoing.","heading":"Industry Recovery — DeFi United","severity":"medium","sources":[{"credibility":1,"name":"CoinDesk: Aave Rallies DeFi Partners to Contain Fallout from $292 Million KelpDAO Hack","type":"news_article","url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack"},{"credibility":1,"name":"CoinDesk: Industry Leaders Are Pouring Hundreds of Millions Into a Rescue Plan for Aave Users","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack"},{"credibility":2,"name":"Unchained Crypto: Aave's DeFi United Recovery Effort Reaches $238 Million As Crypto Rallies to Bail Out Its Biggest Lender","type":"news_article","url":"https://unchainedcrypto.com/aaves-defi-united-recovery-effort-reaches-238-million-as-crypto-rallies-to-bail-out-its-biggest-lender/"},{"credibility":2,"name":"Cryptopolitan: LayerZero Pledges $23M to DeFi United After $292M Kelp DAO Exploit Fallout","type":"news_article","url":"https://www.cryptopolitan.com/layerzero-pledges-23m-to-defi-united/"}]},{"content":"Security researchers and protocol auditors drew broad lessons from the exploit. OpenZeppelin published an analysis titled '$292 Million Lost, Zero Bugs Found: Lessons From the rsETH Bridge Exploit,' highlighting that the attack succeeded without exploiting any smart contract vulnerability. The exploit demonstrated that off-chain infrastructure — RPC nodes, DVN operator systems, developer credentials — constitutes a critical attack surface that is not captured by conventional smart contract audits. The Arbitrum Security Council's decision to freeze funds on-chain raised significant debate about the nature of decentralization; the intervention was effective but discretionary, and illustrated that permissionless networks retain significant points of centralized control at the governance layer. LayerZero's policy shift — banning 1-of-1 DVN configurations and migrating defaults to multi-DVN minimums — affected roughly 47% of its active OApps. KelpDAO announced it would migrate to Chainlink's CCIP infrastructure following the event. The exploit was the second of two state-sponsored North Korean attacks within 18 days in April 2026; the Drift Protocol hack ($285 million) on April 1 preceded it by 17 days, and TRM Labs identified that attackers in both incidents staged their operations over weeks or months before executing rapidly.","heading":"Systemic Implications — Bridge Security and Decentralization","severity":"high","sources":[{"credibility":2,"name":"OpenZeppelin: $292 Million Lost, Zero Bugs Found — Lessons From the rsETH Bridge Exploit","type":"research","url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack"},{"credibility":2,"name":"CryptoBriefing: KelpDAO Blames LayerZero Infrastructure for $292M rsETH Hack, Shifts to Chainlink CCIP","type":"news_article","url":"https://cryptobriefing.com/kelpdao-rseth-hack-impact/"},{"credibility":2,"name":"DeFi Prime: The KelpDAO rsETH Exploit — $292M Minted From a 1-of-1 Bridge, and Who Actually Pays","type":"news_article","url":"https://defiprime.com/kelpdao-rseth-exploit"},{"credibility":2,"name":"Nexus Mutual: KelpDAO & LayerZero Incident Report","type":"other","url":"https://nexusmutual.io/blog/kelpdao-layerzero-incident-report"}]}],"sources_used":[{"credibility":1,"name":"CoinDesk: 2026's Biggest Crypto Exploit — Kelp DAO Hit for $292 Million","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"credibility":1,"name":"CoinDesk: LayerZero Blames Kelp's Setup for $290 Million Exploit, Attributes It to North Korea's Lazarus","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"credibility":1,"name":"CoinDesk: Kelp Claims That LayerZero Approved the Setup It Blamed for $292 Million Bridge Hack","type":"news_article","url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"credibility":1,"name":"TRM Labs: North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks","type":"research","url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks"},{"credibility":2,"name":"Decrypt: LayerZero Pins $292M KelpDAO Bridge Hack on North Korea's Lazarus Group","type":"news_article","url":"https://decrypt.co/364872/layerzero-pins-292m-kelpdao-bridge-hack-on-north-koreas-lazarus-group"},{"credibility":2,"name":"Chainalysis: Inside the KelpDAO Bridge Exploit","type":"research","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":1,"name":"CoinDesk: Arbitrum Freezes $71 Million in Ether Tied to Kelp DAO Exploit","type":"news_article","url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit"},{"credibility":1,"name":"CoinDesk: Inside the $71 Million Freeze on Arbitrum","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/22/inside-the-usd71-million-freeze-on-arbitrum-that-has-the-crypto-world-questioning-what-decentralization-really-means"},{"credibility":1,"name":"Unchained Crypto: U.S. Court Freezes $71 Million in Kelp DAO ETH After North Korea Terrorism Creditors File Claim","type":"court_filing","url":"https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/"},{"credibility":2,"name":"Unchained Crypto: Kelp DAO Exploiter Moves $175 Million in Stolen ETH Through THORChain","type":"news_article","url":"https://unchainedcrypto.com/kelp-dao-exploiter-moves-175-million-in-stolen-eth-into-new-wallets-routing-funds-through-thorchain/"},{"credibility":1,"name":"CoinDesk: Aave Could Face Up to $230 Million in Losses After Kelp DAO Bridge Exploit","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/20/aave-could-face-up-to-usd230-million-in-losses-after-kelp-dao-bridge-exploit-triggers-defi-chaos"},{"credibility":1,"name":"CoinDesk: Aave Rallies DeFi Partners to Contain Fallout from $292 Million KelpDAO Hack","type":"news_article","url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack"},{"credibility":1,"name":"CoinDesk: Industry Leaders Pouring Hundreds of Millions Into Rescue Plan for Aave Users","type":"news_article","url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack"},{"credibility":2,"name":"CryptoTimes: LayerZero Says 'We Own That' After $292M Kelp DAO Hack, Admits Security Mistake","type":"news_article","url":"https://www.cryptotimes.io/2026/05/10/layerzero-says-we-own-that-after-292m-kelp-dao-hack-admits-security-mistake/"},{"credibility":2,"name":"CryptoTimes: LayerZero Details Single-Verifier Flaw Behind $292M KelpDAO Exploit","type":"news_article","url":"https://www.cryptotimes.io/2026/05/20/layerzero-details-single-verifier-flaw-behind-292m-kelpdao-exploit/"},{"credibility":2,"name":"The Block: Kelp DAO Shifts Blame to LayerZero for $292 Million Exploit","type":"news_article","url":"https://www.theblock.co/post/398204/kelp-dao-shifts-blame-layerzero"},{"credibility":2,"name":"The Block: Kelp DAO Exploiter Begins Moving Stolen Funds Across Chains After Arbitrum ETH Freeze","type":"news_article","url":"https://www.theblock.co/post/398239/kelp-dao-exploiter-begins-moving-stolen-funds-across-chains-after-arbitrum-eth-freeze"},{"credibility":2,"name":"The Defiant: Aave Models $124M to $230M in Bad Debt From Kelp Exploit","type":"news_article","url":"https://thedefiant.io/news/hacks/aave-models-usd124m-to-usd230m-in-bad-debt-from-kelp-exploit-layerzero-and-kelp-continue-to"},{"credibility":2,"name":"OpenZeppelin: $292 Million Lost, Zero Bugs Found — Lessons From the rsETH Bridge Exploit","type":"research","url":"https://www.openzeppelin.com/news/lessons-from-kelpdao-hack"},{"credibility":2,"name":"CryptoBriefing: KelpDAO Blames LayerZero Infrastructure for $292M rsETH Hack, Shifts to Chainlink CCIP","type":"news_article","url":"https://cryptobriefing.com/kelpdao-rseth-hack-impact/"},{"credibility":2,"name":"CryptoBriefing: Lazarus Group Exploits THORChain for $292M rsETH Laundering Operation","type":"news_article","url":"https://cryptobriefing.com/lazarus-group-exploits-thorchain-for-292m-rseth-laundering-operation/"},{"credibility":2,"name":"BeInCrypto: LayerZero Ties KelpDAO Exploit to Lazarus Subgroup TraderTraitor","type":"news_article","url":"https://beincrypto.com/layerzero-kelpdao-hack-lazarus-north-korea/"},{"credibility":2,"name":"Nexus Mutual: KelpDAO & LayerZero Incident Report","type":"other","url":"https://nexusmutual.io/blog/kelpdao-layerzero-incident-report"},{"credibility":1,"name":"LayerZero: KelpDAO Incident Statement (official blog)","type":"official","url":"https://layerzero.network/blog/kelpdao-incident-statement"},{"credibility":1,"name":"LayerZero: LayerZero Labs KelpDAO Incident Report (official blog)","type":"official","url":"https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report"},{"credibility":2,"name":"Unchained Crypto: Kelp DAO Disputes LayerZero's Account of the $290 Million Exploit","type":"news_article","url":"https://unchainedcrypto.com/kelp-dao-disputes-layerzeros-account-of-the-290-million-exploit-escalating-blame-game/"},{"credibility":2,"name":"DeFi Prime: The KelpDAO rsETH Exploit — $292M Minted From a 1-of-1 Bridge, and Who Actually Pays","type":"news_article","url":"https://defiprime.com/kelpdao-rseth-exploit"},{"credibility":2,"name":"Crypto.news: North Korea Denies TRM Labs Data Tying It to Major Crypto Hacks","type":"news_article","url":"https://crypto.news/north-korea-denies-trm-labs-data-tying-it-to-major-crypto-hacks/"},{"credibility":2,"name":"Cryptopolitan: LayerZero Pledges $23M to DeFi United After $292M Kelp DAO Exploit Fallout","type":"news_article","url":"https://www.cryptopolitan.com/layerzero-pledges-23m-to-defi-united/"},{"credibility":2,"name":"Yahoo Finance: Arbitrum's KelpDAO Freeze Backfires as US Court Blocks $71 Million Recovery","type":"news_article","url":"https://finance.yahoo.com/markets/crypto/articles/arbitrum-kelpdao-freeze-backfires-us-160122096.html"},{"credibility":2,"name":"Unchained Crypto: Aave's DeFi United Recovery Effort Reaches $238 Million","type":"news_article","url":"https://unchainedcrypto.com/aaves-defi-united-recovery-effort-reaches-238-million-as-crypto-rallies-to-bail-out-its-biggest-lender/"}],"summary":"On April 18, 2026, attackers preliminarily attributed to North Korea's Lazarus Group (TraderTraitor subunit) drained approximately $292 million in rsETH from KelpDAO's LayerZero-powered cross-chain bridge, making it the largest single DeFi exploit of 2026 and accounting for a significant share of all H1 2026 crypto hack losses. The attack exploited a 1-of-1 Decentralized Verifier Node (DVN) configuration by compromising internal RPC nodes and DDoS-ing external nodes, forcing the bridge to accept a phantom burn message and release 116,500 rsETH to attacker-controlled addresses. A public dispute over responsibility followed, with LayerZero initially blaming KelpDAO's configuration before later partially acknowledging its own failure to police high-value transaction security; the exploit created an estimated $124–$230 million in bad debt on Aave and triggered a coordinated DeFi industry recovery effort called DeFi United.","timeline":[{"date":"2023-01-01","event":"Wu Huihui, a Chinese crypto broker later linked to laundering KelpDAO exploit proceeds, is indicted for laundering Lazarus Group crypto thefts. Funding chains from the KelpDAO exploit were later traced to a Bitcoin wallet he controlled as far back as 2018.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks"},{"date":"2026-03-06","event":"Alleged start of the social engineering campaign: attackers harvest session keys from a LayerZero Labs developer, enabling access to LayerZero's RPC cloud environment and planting of poisoned internal RPC nodes in preparation for the exploit.","source":"Web search aggregation of reporting","source_url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"date":"2026-04-01","event":"Drift Protocol hack: alleged North Korean hackers (identified as a distinct group from TraderTraitor) steal $285 million from Drift via compromised multisig signers and exploitation of Solana durable nonce features — the first of two large DPRK attacks in April 2026.","source":"TRM Labs","source_url":"https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks"},{"date":"2026-04-18","event":"At 17:35 UTC, attackers drain 116,500 rsETH (~$292 million) from KelpDAO's LayerZero OFT bridge by compromising internal RPC nodes and DDoS-ing external nodes to force the 1-of-1 DVN to accept a phantom burn message. rsETH is deployed across more than 20 networks.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04-18","event":"At 18:21 UTC, KelpDAO's emergency pauser multisig freezes protocol core contracts. Two follow-up attack attempts at 18:26 and 18:28 UTC (each targeting approximately $100 million) revert. KelpDAO publicly acknowledges the exploit on social media at 20:10 UTC.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"date":"2026-04-19","event":"LayerZero publishes its initial postmortem, attributing the hack with preliminary confidence to North Korea's Lazarus Group / TraderTraitor subunit and placing responsibility on KelpDAO's 1-of-1 DVN configuration.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/20/layerzero-blames-kelp-s-setup-for-usd290-million-exploit-attributes-it-to-north-korea-s-lazarus"},{"date":"2026-04-20","event":"Arbitrum Security Council freezes 30,766 ETH (~$71 million) linked to the exploiter on Arbitrum One, moving funds to an intermediary wallet accessible only through further governance action. The freeze is coordinated with law enforcement.","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit"},{"date":"2026-04-21","event":"Exploiter begins moving approximately 75,701 ETH (~$175 million) into freshly created Ethereum mainnet addresses and begins routing funds through THORChain, converting ETH to Bitcoin. THORChain volume surges approximately 18x.","source":"Unchained Crypto / CryptoTimes","source_url":"https://unchainedcrypto.com/kelp-dao-exploiter-moves-175-million-in-stolen-eth-into-new-wallets-routing-funds-through-thorchain/"},{"date":"2026-04-23","event":"Aave rallies DeFi partners to form DeFi United, a coordinated recovery coalition targeting full restoration of rsETH's backing.","source":"CoinDesk","source_url":"https://www.coindesk.com/business/2026/04/23/aave-rallies-defi-partners-to-contain-fallout-from-usd292-million-kelpdao-hack"},{"date":"2026-04-27","event":"DeFi United coalition pledges exceed $300 million. Major contributors include Mantle (30,000 ETH), Aave DAO (25,000 ETH), Stani Kulechov personally (5,000 ETH), Ether.fi, Lido, and Kelp DAO.","source":"CoinDesk","source_url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack"},{"date":"2026-05-01","event":"U.S. District Court for the Southern District of New York issues a temporary restraining order freezing the same 30,766 ETH held by Arbitrum governance, following a legal claim by North Korea terrorism judgment creditors (Han Kim and Yong Seok Kim) under the Foreign Sovereign Immunities Act and Terrorism Risk Insurance Act.","source":"Unchained Crypto","source_url":"https://unchainedcrypto.com/u-s-court-freezes-71-million-in-kelp-dao-eth-after-north-korea-terrorism-creditors-file-claim/"},{"date":"2026-05-05","event":"KelpDAO publishes 'Setting the Record Straight Around the LayerZero Bridge Hack,' citing Telegram screenshots to argue LayerZero personnel reviewed and approved the 1-of-1 DVN setup over 2.5 years and eight integration discussions.","source":"CoinDesk","source_url":"https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack"},{"date":"2026-05-10","event":"LayerZero publishes an updated statement admitting: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions' and 'We own that,' reversing its earlier position that responsibility lay solely with KelpDAO.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/10/layerzero-says-we-own-that-after-292m-kelp-dao-hack-admits-security-mistake/"},{"date":"2026-05-20","event":"LayerZero publishes detailed technical breakdown of the single-verifier flaw behind the exploit and confirms migration of all OApp defaults to a minimum 3/3 DVN configuration, with a target of 5/5.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/05/20/layerzero-details-single-verifier-flaw-behind-292m-kelpdao-exploit/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 14ec462f-b057-45fe-8c7b-ab8f52a6c471copy