← KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarusreviewed 2026-10-28 · 10 claims checked
Fact-check findings
What an automated fact-checker found when it re-read KelpDAO / LayerZero Bridge Exploit (April 2026) — DPRK Lazarus against the sources the page cites. Only the most recent review is shown.
Read this first
These findings are produced by an automated reviewer, and its results vary between runs: the same page, checked three times on the same day, came back with 15%, 20% and 34% of its claims disputed, mostly because each run extracted a different number of claims. Treat what follows as leads, not rulings.
“Disputed” means the reviewer could not reconcile the claim with the evidence it cited. It does not mean the claim is false. “Unverifiable” means no reachable source settled it either way.
Nothing here changes the page on its own. A proposed correction is applied only after a human moderator approves it; until then the page reads as it did when reviewed.
unverifiable
2 claimsNo source the reviewer could reach confirms or contradicts the claim.
- #6[unverifiable][awaiting moderator]in section: Contagion Into Aave's Lending Markets
“One report indicates the council vote was 9-of-12 in favor.”
reviewerCouncil vote was 9-of-12Not in either cited source and the sentence names no source. - #10[unverifiable][awaiting moderator]in section: Remediation: Kelp DAO's Migration to Chainlink CCIP
“A single lower-tier source names Amitej G. and Dheeraj B. — also described as founders of Stader Labs — as Kelp DAO's founders”
reviewerKelp DAO's founders named as Amitej G. and Dheeraj B.; flagged low-confidenceNot checked against the cited tier-3 source. The page already flags it as uncorroborated.
stale
2 claimsThe claim was accurate when written but events since have overtaken it.
- #7[stale][awaiting moderator]in section: Contagion Into Aave's Lending Markets
“This freeze is a containment measure; the funds have not been returned to Kelp DAO or affected users, and the freeze does not resolve the separate blame dispute between Kelp DAO and LayerZero.”
reviewerFrozen ETH has not been returned and remains pending, and is not part of DeFi United (superseded by Arbitrum DAO vote of May 2026)Page is silent on the DAO approval and the court order, so the 'pending' framing is out of date. Final transfer status could not be confirmed.Proposed correction (not yet applied)This freeze began as a containment measure. In May 2026 the Arbitrum DAO voted to release about 30,766 ETH to the DeFi United recovery effort, but a May 1 court order sought by holders of North Korea terrorism judgments restricts the funds, and the freeze does not resolve the separate blame dispute between Kelp DAO and LayerZero. - #8[stale][awaiting moderator]in section: Recovery Effort: The "DeFi United" Coalition
“it was not treated as part of these fresh DeFi United pledges in the reporting reviewed, and any proposal to redirect those frozen funds into Aave's rescue would require a separate governance process.”
reviewerFrozen funds were not treated as part of DeFi United pledges and would need separate governanceAccurate as of late April, superseded by the governance vote in May.Proposed correction (not yet applied)it was not initially counted among these fresh DeFi United pledges; on May 8, 2026 the Arbitrum DAO voted to release it to DeFi United, subject to a court order restricting the funds.
partially supported
2 claimsThe cited evidence supports part of the claim but not all of it.
- #2[partially supported][awaiting moderator]in section: Attack Mechanics: RPC Compromise and a Single-Verifier Configuration
“LayerZero's incident report states that the rsETH deployment had at some earlier point used a 2-of-2 DVN configuration and was later changed to 1-of-1, though LayerZero's report does not specify when this change occurred or who made it”
reviewerLayerZero's report says rsETH used 2-of-2 DVN earlier and was changed to 1-of-1Headline supports it; the hedge about unspecified timing is consistent with what was readable. Body of article not fully accessible. - #4[partially supported][awaiting moderator]in section: Arbitrum Security Council Freeze
“TRM Labs separately noted that THORChain "processed the vast majority of proceeds" from both North Korea's 2025 Bybit hack and the 2026 KelpDAO hack”
reviewerTHORChain processed the vast majority of proceeds from Bybit and KelpDAO (TRM); page correctly declines to give a combined figureTakeaway wording matches; the body is less categorical, so the quoted phrase is a little stronger than the body text.
confirmed
4 claimsThe cited evidence supports the claim as written.
- #1[confirmed][no action needed]in section: The Exploit: Timeline and Scale
“An attacker drained 116,500 rsETH — then worth approximately $292 million and roughly 18% of circulating supply — from Kelp DAO's LayerZero-powered bridge on April 18, 2026, at 17:35 UTC.”
reviewerExploit scale and intraday timeline (116,500 rsETH, ~$292M, ~18% supply, 17:35 UTC drain, 18:21 freeze, reverted attempts, 20:10 acknowledgement)Matches CoinDesk, including follow-up attempts and the 20:10 UTC acknowledgement. - #3[confirmed][no action needed]in section: Attribution to North Korea's Lazarus Group / TraderTraitor
“Blockchain analytics firm TRM Labs separately attributed the KelpDAO breach to TraderTraitor in a report on North Korea-linked crypto theft”
reviewerLayerZero attributed the attack to Lazarus/TraderTraitor; TRM separately attributed KelpDAO to TraderTraitor and treats Drift as distinctFigures and the Drift distinction match TRM. - #5[confirmed][no action needed]in section: Contagion Into Aave's Lending Markets
“The Arbitrum Security Council took emergency action to freeze 30,766 ETH tied to the exploit, moving it into an intermediary wallet on Arbitrum One; the transfer completed at 11:26 p.m. ET on April 20, 2026, according to Arbitrum's own statement.”
reviewerArbitrum Security Council freeze of 30,766 ETH (~$71M), completed 11:26 p.m. ET April 20Matches CoinDesk. - #9[confirmed][no action needed]in section: Litigation: Kelp DAO's Evercrest Technologies Sues LayerZero and Co-Founder
“Evercrest Technologies Inc., the corporate entity behind Kelp DAO, filed a notice of civil claim against LayerZero Labs Ltd. and LayerZero co-founder Bryan Pellegrino in British Columbia, Canada (Vancouver Law Courts, case file number 267169)”
reviewerEvercrest Technologies filed a civil claim in BC (file 267169) alleging failure to disclose, negligence and defamation; Pellegrino called it meritlessSupported by other reporting. Coverage varies on whether the plaintiff is named Evercrest or KelpDAO. The page also quotes the filing slightly differently from CoinDesk's longer wording ('inherent in LayerZero's own technology').
How this fits together. The reviewer reads the published page and its cited sources and records one finding per claim. A human moderator decides whether each proposed correction is applied; those decisions, and the score changes they cause, appear in the audit log. Earlier review runs are not shown here; only the latest reflects the page as it stands.