KelpDAO, a liquid restaking protocol, was exploited for approximately $290 million on April 18, 2026, in a sophisticated attack now attributed to North Korea's Lazarus Group. The attackers stole 116,500 rsETH (restaked ETH) by compromising the cross-chain message verification system.
The attack vector was a highly targeted cross-chain message spoofing attack. According to post-incident analysis by LayerZero, the attacker first gained access to the list of RPC nodes used by LayerZero's Decentralized Verifier Network (DVN). They then poisoned two of these nodes to deliver a fake cross-chain message. Simultaneously, a Distributed Denial-of-Service (DDoS) attack was launched against clean nodes, forcing the DVN to rely on the compromised ones. This allowed the forged message to pass validation.
The root cause was identified as KelpDAO's use of a 1-of-1 DVN setup, which had no redundancy or backup verifiers. LayerZero stated this created a single point of failure, with "no independent verifier to catch and reject a forged message." The company noted it had previously communicated best practices around DVN diversification to KelpDAO and will no longer sign messages for applications using a 1/1 DVN configuration.
The fallout from the exploit rippled across the broader DeFi ecosystem. The attacker moved the stolen rsETH to Aave V3, using it as collateral to borrow large amounts of Wrapped Ethereum (WETH). This raised concerns over potential bad debt, prompting Aave to freeze rsETH markets on both its V3 and V4 platforms. Aave founder Stani Kulechov confirmed the freeze, stating the asset lost its borrowing power due to the exploit.
Historical data showed over $10 billion in outflows from Aave following the attack, with total supplied funds dropping from $45.8 billion to $35.7 billion. The stress extended further, causing the total value locked (TVL) across all of DeFi to drop by 7% in 24 hours, from $99.5 billion to about $86.3 billion. As a precaution, several other major DeFi protocols—including Ethena, ether.fi, Tron DAO, and Curve Finance—paused their LayerZero OFT bridges.
LayerZero and law enforcement are continuing efforts to trace the stolen funds. The company emphasized that there is "zero contagion" for other assets or applications using multi-DVN setups, as the exploit was isolated to KelpDAO's specific configuration. The protocol's infrastructure has since been replaced and secured.
