Kelp DAO: The $292M Bridge Exploit

At 17:35 UTC on Saturday 18 April 2026, Kelp DAO's bridge on Ethereum received a message saying that 116,500 of its tokens had just been destroyed on another network and should be released on this one. Nothing had been destroyed. The bridge released them anyway, to a wallet controlled by the attacker. They were worth about $292 million.

It took Kelp 46 minutes to pause its contracts, at 18:21 UTC. Two more forged messages, each trying to take another 40,000 tokens, about $100 million each time, arrived minutes later and failed because the pause was in place. Kelp did not say anything in public until 20:10 UTC. By then the damage had spread far beyond Kelp.

At the time it was the biggest crypto theft of 2026, just ahead of the $285 million taken from Drift Protocol on 1 April. It has since been overtaken by the $319 million drained from Liquid Network in September and the $387.5 million taken from the exchange Bitget. But no other 2026 hack caused as much damage to bystanders.

What Kelp sold

Kelp DAO, a product of a company called KernelDAO, sold a token called rsETH. Customers handed Kelp ether, the coin of the Ethereum network, and Kelp put it to work. First it was staked, which means locked up to help run the Ethereum network in return for interest, much like a fixed-term deposit. Then it was restaked through a service called EigenLayer, which pledges the same deposit as security for other services in return for extra interest, like using one house as collateral for two loans. rsETH was the customer's receipt. The receipt could itself be traded, or pledged as collateral to borrow money.

Kelp made rsETH available on more than 20 blockchains, separate networks such as Arbitrum, Base and Linea that are cheaper to use than Ethereum. It did that with a bridge, built on software from LayerZero Labs. The bridge worked like a currency exchange desk at a border: the real rsETH stayed locked in a safe on Ethereum, and the other networks got vouchers backed by it. When a voucher was destroyed on another network, the bridge released the real token from the safe. That is the instruction the attacker forged. The 116,500 tokens were about 18% of all rsETH in existence, and they were the backing for the vouchers on the other networks. Those vouchers were suddenly backed by an empty safe.

How the message was forged

Messages between blockchains need someone to check them. LayerZero lets each customer choose its checkers, called verifiers, and how many must agree. Kelp used one: a verifier run by LayerZero Labs itself. One signature was enough to open the safe.

According to LayerZero's post-mortem, the attackers did not break that verifier. They broke what it read. Verifiers look up what happened on other blockchains by asking servers called RPC nodes, the equivalent of a clerk phoning a bank branch to confirm a deposit. The attackers took over two of the internal nodes LayerZero ran and programmed them to lie only about this one transaction while telling the truth to everyone else, including LayerZero's own monitoring. At the same time they flooded an outside node with junk traffic so the verifier would fall back on the poisoned ones. The nodes reported a burn of rsETH on Unichain that never happened. The verifier signed, and the safe opened. The nodes were set to delete their own malicious code and logs afterwards.

LayerZero said North Korea's TraderTraitor unit, part of the Lazarus Group and the same operation the FBI blamed for the $1.5 billion Bybit theft, was behind it. Its report was prepared with the security firms Mandiant, CrowdStrike and zeroShadow. No government has formally attributed the attack, and nobody has been charged.

The run on Aave

The attacker did not simply sell the stolen rsETH. The tokens went to seven wallets and most of them, 89,567 rsETH, were pledged as collateral on Aave, the largest lending market in crypto, which works like a pawnbroker run by software. Against them the attacker borrowed about 82,650 ether and 821 wrapped staked ether, real coins that could be taken away. More rsETH went into the rival lender Compound. The pawnbroker was left holding receipts for a safe that had just been emptied.

Aave froze its rsETH markets within hours. Its founder, Stani Kulechov, said Aave's own code had not been compromised. Lenders did not wait to find out. Aave's own estimate put the possible bad debt, loans that would never be repaid, at between $124 million and $230 million, and depositors pulled out more than $10 billion within about a week. For a time so much ether had been borrowed that withdrawals of ether from Aave were stuck. SparkLend and Fluid froze their rsETH markets too, and Lido paused deposits into a product with rsETH exposure.

The money, the rescue and the courts

On 21 April the Arbitrum Security Council, a group with emergency powers over the Arbitrum network, froze 30,766 ether (about $71 million) that the attacker had parked there. The attacker moved everything else. Roughly 75,700 ether, about $175 million, went out first, mostly converted to bitcoin through THORChain, a service that swaps one coin for another without asking who the customer is, then through privacy tools such as Tornado Cash, Wasabi and Umbra. By early June analysts reported that nearly all of the roughly $220 million not frozen had been laundered.

The industry then paid for the hole itself. Aave led a coalition called DeFi United, joined by Consensys, Mantle, Arbitrum, Lido, EtherFi, LayerZero and Kelp, which gave 2,000 ether from its treasury. Pledges passed $300 million. The attacker's Aave and Compound positions were liquidated, which recovered about 107,000 of the missing rsETH by 18 May, and the coalition's ether covered the rest. Kelp reopened rsETH withdrawals and bridging on 15 May, and Aave unpaused its markets the same day.

The frozen ether ran into a different claim. Lawyers for American families who hold old, unpaid court judgments against North Korea, worth more than $877 million, argued that ether stolen by North Korean hackers was North Korean property they could seize. On 1 May they served a restraining notice that locked the funds. On 8 May Judge Margaret Garnett of the US District Court for the Southern District of New York let Arbitrum's token holders, who had voted about 91% in favour, send the ether to an Aave-controlled wallet, but only on condition that Aave stays bound by the notice. Who ultimately owns it has not been decided.

Kelp and LayerZero, meanwhile, blamed each other. LayerZero said it had advised against a single verifier. Kelp published messages it said showed LayerZero staff approving the setup, and moved rsETH to a rival bridge system, Chainlink's CCIP, with four independent checkers. In late September Evercrest Technologies, the company behind Kelp, sued LayerZero and its co-founder Bryan Pellegrino in the Supreme Court of British Columbia, alleging that LayerZero failed to disclose the risks of its technology and approved the configuration in writing. Pellegrino called the claim "meritless". The case has not been heard.