On April 18, Kelp DAO lost $292 million in what stands as the largest DeFi exploit of 2026. The root cause was not a smart contract bug but a misconfigured LayerZero bridge: a 1-of-1 Decentralized Verifier Network (DVN) setup that allowed a single compromised node to forge cross-chain messages. Twelve days earlier, on April 6, an open-source AI audit tool had already flagged this attack surface.
How the Attack Unfolded
Kelp DAO is a liquid restaking protocol built on EigenLayer. Users deposit ETH or liquid staking tokens to receive rsETH, which could be transferred across 16+ chains via LayerZero's OFT standard. At 17:35 UTC on April 18, the attacker breached the solitary DVN node, got it to approve a fake cross-chain message, and the Kelp OFT contract minted 116,500 rsETH on Ethereum mainnet against non-existent collateral. The stolen rsETH was then deposited into Aave V3, Compound V3, and Euler to borrow ~$236 million in WETH, later funneled through Tornado Cash. Within 46 minutes Kelp's emergency pause froze the contracts, but Aave V3 was left with ~$177 million in bad debt, causing AAVE to drop 10.27%. WETH utilization on Aave hit 100% instantly.
The Tool's Five Predictions
The tool, called crypto-project-security-skill, was built by a developer to assess governance, oracle, cross-chain and economic risks—areas traditional scanners ignore. The April 6 audit gave Kelp a 72/100 (medium risk) and flagged five key findings:
- Opaque DVN configuration: Kelp did not disclose its DVN validator set and threshold. It turned out to be 1-of-1—a single point of failure.
- Single point across 16 chains: A compromised DVN could affect rsETH on all deployed chains. After the hack, LayerZero suspended all OFT bridges from Ethereum, stranding rsETH holders on 20+ L2s.
- Unverified governance control: The tool noted whether bridge config changes fell under the same 6/8 multisig + 10-day timelock as core upgrades. They did not, leaving an administrative key in charge.
- Match with Ronin/Harmony patterns: The tool's pattern-matching module correctly identified bridge validator compromise as the highest risk, drawing parallels to the Ronin (5-of-9) and Harmony (2-of-5) hacks. Kelp's 1-of-1 was even worse.
- No insurance buffer: The protocol lacked any insurance pool or loss socialization, so the entire $292M loss cascaded to downstream protocols. Aave's recovery reserve covered less than 30% of its bad debt.
What the Tool Got Wrong
The developer admits three mistakes: risk rating was too low (cross-chain risk should have been high/critical); the tool failed to verify the actual DVN threshold on-chain via LayerZero's EndpointV2 contract (which would have revealed the 1-of-1 configuration); and findings were not actionable enough—flagging opacity rather than a concrete exploit path.
On Responsible Disclosure
Why didn't the developer notify Kelp before the attack? The report flagged non-transparency, not a specific vulnerability. In hindsight, a direct message asking about DVN thresholds might have triggered a fix. The developer calls this a lesson: even vague concerns are worth a private heads-up.
Kelp's exploit underscores that DeFi security cannot rely solely on smart contract audits. Structural risks in bridge configuration, governance, and operational decisions demand new tools. The open-source AI agent provided a preview of that capability—but also showed how much room for improvement remains.