WEB3-KELPDAO-LAYERZERO-2026
Web3 · Ethereum · KelpDAO / rsETH (LayerZero bridge)
Summary
On April 18, 2026, North Korea's Lazarus Group drained about 116,500 rsETH (roughly $292 million) from KelpDAO's LayerZero-based bridge, the largest DeFi exploit of the year. No smart contract was broken; the contracts did exactly what they were written to do. The attack was against the bridge's off-chain verification. rsETH's LayerZero channel was configured to trust a single verifier (a 1-of-1 DVN), so the attackers compromised LayerZero's internal RPC nodes, knocked out the honest external node with a denial-of-service flood, and forced that single verifier to attest to a cross-chain message that never really happened. The Ethereum side then released unbacked rsETH from escrow, leaving wrapped rsETH stranded across more than twenty chains and triggering a bank-run across DeFi.
How to fix it
- Never run 1-of-1 verification on a value-bearing bridge; require X-of-N attestation from independent DVNs run by different entities so one compromised verifier cannot authorize a release.
- Make verification fail closed: if the honest data path is lost (for example to a denial-of-service flood), halt rather than failing over to whatever node is still reachable.
- Cross-reference RPC responses across multiple independent providers and treat any mismatch as an attack signal; run your own nodes for sensitive verification.
- Monitor cross-chain invariants, not just per-transaction validity; alert when an escrow release has no matching source-chain burn.
How to avoid it in your code
- Treat deployment-time configuration (DVN sets, verifier thresholds, RPC dependencies) as a live attack surface that audits of contract code do not cover, and revisit it as the protocol evolves.
- Harden the human and infrastructure layer: the root entry here was a phished developer and stolen session keys, so protect session-key handling and infrastructure access as tier-0.
- Diversify and isolate verifier and RPC infrastructure so a single cloud compromise cannot poison the data feeding consensus.
- Add independent monitoring and timelocks on large escrow releases so a forged message cannot drain funds instantly.
Advisory details
How it happened
LayerZero is a cross-chain messaging layer. Before a destination contract acts on a message, a configured set of Decentralized Verifier Networks (DVNs) must independently attest that the source-chain event really occurred. The security model is X-of-N: require several independent verifiers so no single one can lie. rsETH was configured 1-of-1, a single required verifier (the LayerZero Labs DVN), which made that one verifier a total single point of failure. rsETH itself uses a lock-box model: Ethereum holds the canonical rsETH in escrow while wrapped versions circulate on layer-2 chains. To move value back to Ethereum, the wrapped token is burned on the source chain, the DVN verifies the message, and the Ethereum adapter releases an equal amount from escrow.
The attackers spent six weeks inside before striking. Around March 6 they socially engineered a LayerZero developer and harvested session keys, pivoting into LayerZero's RPC cloud. On April 18 they memory-patched two internal RPC nodes to return forged data while still looking healthy to monitoring, then hit the honest external node with a denial-of-service flood. With the honest path gone, the DVN failed over to the two compromised nodes, which reported a phantom rsETH burn on a layer-2 chain that never happened. The single 1-of-1 verifier signed the fraudulent message as valid, and Ethereum's adapter dutifully released 116,500 rsETH from escrow to the attacker, fully unbacked.
The damage
The 116,500 rsETH (about 18 percent of supply) left the Ethereum escrow empty while wrapped rsETH kept circulating on more than twenty layer-2 chains with nothing behind it, a backing crisis rather than a simple price depeg. Lending markets froze rsETH within hours; the attacker had also pledged stolen rsETH as Aave collateral, leaving roughly $177 million to $190 million of bad debt. Around $14 billion fled DeFi in the panic and AAVE fell about 10 percent. It was not a total loss: KelpDAO's contract pause blocked a second attempt worth about $95 million, and the Arbitrum Security Council froze 30,766 ETH with law enforcement. A "DeFi United" coalition backstopped rsETH while KelpDAO re-collateralized in tranches (May 13 and May 25) and reopened the bridge.
Who was behind it
LayerZero attributed the attack to Lazarus Group, specifically the TraderTraitor sub-cluster (also tracked as UNC4899), with high confidence corroborated by Mandiant and CrowdStrike. The pattern is signature Lazarus: socially engineer a developer, compromise infrastructure rather than contract code, then launder cross-chain. It places this alongside the group's other infrastructure and social-engineering heists, including Ronin, Bybit, Radiant Capital, and Drift. A public blame war followed: LayerZero first framed 1-of-1 as KelpDAO's choice (a downgrade from 2-of-2), while KelpDAO said 1-of-1 was LayerZero's default onboarding recommendation, used by nearly half of active LayerZero contracts at the time. LayerZero ultimately apologized and accepted fault.
Why it still matters
The headline is that an audit would not have helped: as OpenZeppelin put it, $292 million was lost with zero bugs found. Every transaction was individually valid; the broken invariant, releasing escrow with no matching burn, existed only across chains and was invisible to single-chain monitoring. The single point of failure was a configuration choice, not a line of Solidity, which is why it belongs in the same family as the bridge hacks at Wormhole, Nomad, and Poly Network: cross-chain message verification is the real attack surface, and a single trusted verifier or RPC source is a catastrophe waiting to happen. In response, the LayerZero Labs DVN now refuses to act as the sole signer on any channel and enforces a minimum security baseline across the ecosystem.
References
- https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/
- https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report
- https://www.openzeppelin.com/news/lessons-from-kelpdao-hack
- https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains
- https://www.theblock.co/post/400629/layerzero-issues-public-apology-for-kelp-dao-exploit-response-admits-fault-in-single-verifier-setup
Related vulnerabilities
All Web3 →- HIGHWEB3-FRONTEND-DNS-HIJACK-2022
A frontend hijack leaves the on-chain contracts untouched but replaces the Web2 surface serving the dApp UI with a wallet-drainer clone, so no Solidity audit can catch it. The recurring pattern: attackers take over the domain registrar or DNS provider account (or a CDN/tag-manager account), repoint the domain to a cloned site, and prompt visitors to sign malicious token approvals, EIP-2612 permit signatures, or transfers. Curve Finance was hit twice: on August 9-10, 2022 its curve.fi domain was DNS-hijacked via a compromised nameserver and drained ~$570K in USDC/DAI; and again around May 12, 2025 at the registrar level, after which Curve permanently migrated to curve.finance and announced an ENS move (Convex Finance and Resupply, which depend on Curve's data feeds, suffered dependency-driven outages but were not themselves compromised). In July 2024 a mass wave hit DeFi domains registered through Squarespace, whose forced migration off Google Domains stripped 2FA: Compound's frontend redirected to an Inferno Drainer clone and 100+ protocols were exposed (Celer blocked its takeover via domain monitoring). Ambient Finance's domain was hijacked through stolen registrar credentials on October 17, 2024. Most recently, on April 14, 2026 attackers used forged identity documents to social-engineer the registrar into handing over DNS control of CoW Swap's swap.cow.fi and cow.fi domains, redirecting users to a pixel-perfect drainer clone for about 90 minutes; over $1M was taken in roughly three hours, including 219 ETH (~$750K) from a single wallet, while CoW's contracts, backend APIs, and solver network were untouched. The same bucket includes CDN-account injections (KyberSwap's September 2022 Cloudflare/Google Tag Manager compromise, ~$265K) and BGP route hijacks that swap signed bundles for drainer code.
- HIGHWEB3-CURVE-DNS-2025
On May 12, 2025, attackers hijacked Curve Finance's primary domain, curve.fi, at the registrar and DNS level and pointed visitors at a wallet-draining clone of the site. Curve's smart contracts and on-chain funds were never touched; this was a Web2 attack on the domain, the soft underbelly that no Solidity audit can protect. The nameservers for curve.fi were swapped to attacker-controlled infrastructure at the registrar (iwantmyname, the same registrar implicated in Curve's 2022 hijack), and the clone prompted users to approve malicious token transactions. On-chain analysts estimated user losses around $520,000, most of it taken in the first ninety minutes. Curve repointed the domain to neutral nameservers, then permanently migrated to curve.finance and signaled a move toward decentralized (ENS) hosting.
- CRITICALWEB3-KILOEX-2025
On April 14, 2025 the perpetuals DEX KiloEx lost about $7.5 million across BNB Chain, Base, opBNB, and Taiko to what was reported as oracle price manipulation but was really an access-control failure. KiloEx's price feed (KiloPriceFeed.setPrices) was meant to be reachable only through a keeper-gated call chain, but the top-level MinimalForwarder.execute function was publicly callable and validated an attacker-supplied signature against attacker-supplied data, letting anyone forge a trusted call that reached setPrices and write an arbitrary price. The attacker set a market price far below true value, opened a leveraged position, then set the price far above value and closed it in the same flow, extracting fabricated profit from the vault; the sequence was repeated across all four chains, with a single transaction netting $3.12M. Reporting that framed it as flash-loan oracle manipulation was imprecise: no market liquidity was moved, the price was simply written directly through the unprotected forwarder. After KiloEx offered a 10% (~$750K) whitehat bounty and no legal action, the attacker returned essentially all of the funds by April 18, 2025.
- CRITICALWEB3-BYBIT-2025
On 21 February 2025, the crypto exchange Bybit lost about $1.5 billion in ether, the largest hack in history, to North Korea's Lazarus Group. Bybit had done what custody best-practice prescribes: the funds sat in a cold wallet behind a multisig requiring several human signers. The attackers beat it anyway, not by stealing keys but by tampering with what the signers saw. Weeks earlier they had compromised a developer at Safe, the multisig-wallet provider, and slipped malicious code into the Safe web app, so that when Bybit's executives reviewed a routine transfer, the screen showed a legitimate transaction while their hardware wallets were actually signing a malicious one that handed the wallet to the attacker. It is the defining lesson that a multisig is only as trustworthy as the screen you approve it on, and that blind-signing is the modern crypto catastrophe.
- CRITICALWEB3-RADIANT-2024
On October 16, 2024, the cross-chain lending protocol Radiant Capital lost roughly $50M (about $53M across Arbitrum and BSC) after attackers compromised the devices of at least three of its multisig signers. Initial access began September 11, 2024 via a Telegram message spoofing a trusted former contractor, delivering a ZIP with a decoy PDF that was actually a macOS application carrying INLETDRIFT backdoor malware. The malware sat between the signers' browsers and their hardware wallets, so the Safe (Gnosis) UI and Tenderly simulations displayed correct data while the signers blind-signed a malicious transferOwnership() call on the LendingPoolAddressesProvider contract; the 3-of-11 threshold was met and the attacker then upgraded the pools to a malicious implementation and drained them. Mandiant assessed with high confidence the attack was conducted by North Korea-linked UNC4736 (aka Citrine Sleet/AppleJeus), part of the Lazarus cluster. Funds were not recovered and the protocol later wound down.
- CRITICALWEB3-WAZIRX-2024
On July 18, 2024 Indian exchange WazirX lost approximately $230M (about $234.9M) from a Safe (Gnosis) 4-of-6 multisig wallet held under a custody arrangement with Liminal (five WazirX keys plus one Liminal key). The attack was a blind-signing exploit: signers reviewed benign transaction details in the manipulated Liminal interface while the payload actually signed differed, authorizing a delegatecall (function selector 0x804e1f0a) that overwrote slot0 of the Safe proxy and repointed its implementation to an attacker-controlled contract (0xef279c2ab14960aa319008cbea384b9f8ac35fc6). Once the proxy pointed to attacker logic the wallet was fully controlled without further keys, and it was drained. The theft was attributed to North Korea's Lazarus Group, later confirmed in a joint statement by the US, South Korea and Japan in January 2025. Funds were laundered via Tornado Cash; victims are being repaid through a court-approved restructuring (resumed October 2025, BitGo custody) rather than direct recovery.