Verify a decision

{"actor":"system:backfill","investigation_id":"88d2319d-13ce-45ee-b572-d4555adf0862","kind":"publish","page_slug":"kelp","published_at":"2026-05-19T20:04:10.709Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Kelp","sections":[{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://kelp.gitbook.io/kelp"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/295972/ethereum-kelp-token-round-valuation"},{"credibility":3,"name":"","type":"other","url":"https://nansen.ai/post/what-is-kelp-dao"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://kelp.gitbook.io/kelp"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2026/05/06/kelpdao-blames-layerzero-shifts-to-chainlinks-ccip-after-292m-hack/"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026"},{"credibility":3,"name":"","type":"other","url":"https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2026/04/19/2026s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit"},{"credibility":3,"name":"","type":"other","url":"https://governance.aave.com/t/rseth-precautionary-freezing-30-04-2025/21925"},{"credibility":3,"name":"","type":"other","url":"https://x.com/KelpDAO/status/1917503028267213270"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit"},{"credibility":3,"name":"","type":"other","url":"https://kelp.gitbook.io/kelp/audits"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://iq.wiki/wiki/amitej-gajjala"},{"credibility":3,"name":"","type":"other","url":"https://theorg.com/org/kelp-dao/org-chart/dheeraj-borra"},{"credibility":3,"name":"","type":"other","url":"https://www.theblockbeats.info/en/news/53822"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.cryptopolitan.com/north-korea-creditors-target-kelp-dao-funds/"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/markets/2026/04/21/arbitrum-freezes-usd71-million-in-ether-tied-to-kelp-dao-exploit"}]},{"content":"","heading":"","severity":"medium","sources":[{"credibility":3,"name":"","type":"other","url":"https://www.halborn.com/blog/post/explained-the-kelp-dao-hack-april-2026"},{"credibility":3,"name":"","type":"other","url":"https://www.theblock.co/post/399118/defi-united-detailed-plan"},{"credibility":3,"name":"","type":"other","url":"https://www.cryptotimes.io/2026/05/13/kelp-dao-aave-set-to-resume-rseth-operations-after-292m-exploit-recovery/"},{"credibility":3,"name":"","type":"other","url":"https://www.coindesk.com/tech/2026/04/27/industry-leaders-are-pouring-hundreds-of-millions-into-a-rescue-plan-for-aave-users-after-massive-crypto-hack"},{"credibility":3,"name":"","type":"other","url":"https://www.pymnts.com/cryptocurrency/2026/kelp-dao-293-million-hack-largest-defi-theft-of-2026/"}]}],"sources_used":[],"summary":"Kelp (also known as Kelp DAO) is a liquid restaking protocol built on Ethereum and EigenLayer that issues rsETH, a liquid restaked token. In April 2026 the protocol suffered the largest DeFi exploit of 2026 to date when attackers, attributed to North Korea's Lazarus Group, drained approximately $292 million in rsETH through a compromised LayerZero cross-chain bridge configuration. The protocol and an industry coalition dubbed DeFi United are actively working to restore collateral and resume operations as of May 2026.","timeline":[{"date":"2023-11-01","event":"Kelp DAO launches rsETH liquid restaking protocol on Ethereum and EigenLayer; Code4rena public audit completed.","source":""},{"date":"2024-02-01","event":"Kelp begins private token round for KELP governance token at $90 million fully diluted valuation.","source":""},{"date":"2024-03-01","event":"Kelp closes $9 million private token round led by SCB Limited and Laser Digital (Nomura) with participation from Bankless Ventures, Hypersphere, Draper Dragon, and others.","source":""},{"date":"2025-04-30","event":"Kelp discloses bug in fee minter contract causing excess rsETH minting; deposits and withdrawals paused. No user funds lost. Aave precautionarily freezes rsETH markets.","source":""},{"date":"2026-04-18","event":"Kelp DAO's LayerZero-powered cross-chain bridge exploited for approximately $292 million (116,500 rsETH). Attack attributed to North Korea's Lazarus Group (TraderTraitor). Kelp pauses contracts, blocking an alleged follow-up $95 million theft attempt.","source":""},{"date":"2026-04-19","event":"Exploit confirmed as largest DeFi hack of 2026. Aave, SparkLend, and Fluid freeze rsETH markets. Over $13 billion in DeFi TVL exits within 48 hours.","source":""},{"date":"2026-04-20","event":"Kelp DAO publicly alleges LayerZero's default configuration settings caused the exploit. Arbitrum Security Council freezes approximately $71 million in attacker funds on Arbitrum.","source":""},{"date":"2026-04-27","event":"DeFi United coalition — including Aave, Lido, EtherFi, Ethena, Mantle, and LayerZero — announces $300 million+ rescue plan to restore rsETH backing and compensate affected users.","source":""},{"date":"2026-05-06","event":"Kelp DAO publishes detailed memo alleging LayerZero personnel directly approved the vulnerable bridge configuration. Kelp announces migration from LayerZero OFT to Chainlink CCIP.","source":""},{"date":"2026-05-09","event":"LayerZero publicly acknowledges it 'made a mistake' in approving the vulnerable verification configuration used by Kelp's bridge.","source":""},{"date":"2026-05-13","event":"Kelp DAO and Aave announce plans to resume rsETH operations as recovery progresses; DeFi United coalition begins phased rsETH collateral restoration.","source":""}]},"v":1}