Incident case file
Sign in to watchKelpDAO — LayerZero Bridge Exploit (Forged DVN Attestation)
0 views
Estimated loss
Victims identified
Investigation
Facts and investigation
Attacker: 0x8B1b6c9A6DB1304000412dd21Ae6A70a82d60D3b
Timeline: April 18, 17:35 UTC — 116,500 rsETH drained in a single transaction via forged LayerZero bridge message. Attacker had replaced binaries on 2 internal RPC nodes (op-geth) and DDoS'd external nodes to force failover, tricking the sole 1-of-1 DVN. 17:35–18:21 UTC — attacker deposits rsETH on Aave V3/V4, borrows ~$190M WETH. 18:21 UTC — Kelp pauses all contracts. 18:26 & 18:28 UTC — two additional drain attempts of 40,000 rsETH each blocked. April 21 — Arbitrum Security Council freezes ~30,765 ETH. April 20 — LayerZero attributes attack to North Korea's Lazarus Group (TraderTraitor); Kelp disputes, claiming 1/1 DVN was LayerZero's default configuration.
Sources and coverage
- Articlecoindesk.comhttps://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains
- Articlechainalysis.comhttps://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/
- Articlehypernative.iohttps://www.hypernative.io/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed
- Articletheblock.cohttps://www.theblock.co/post/397988/kelp-daos-rseth-bridge-apparently-exploited-for-roughly-292-million-in-layerzero-based-attack
- Articledefiprime.comhttps://defiprime.com/kelpdao-rseth-exploit
Victim testimonies
No testimonies yet.
+ Add my testimony → (coming soon)