Kelp DAO lost 116,500 rsETH worth about $292 million after a LayerZero bridge configuration issue was exploited, triggering market freezes and pushing Aave bad debt estimates to $177 million-$200 million.
LayerZero said the $290 million KelpDAO exploit on April 18, 2026, stemmed from poisoned RPC nodes that distorted DVN verification. The incident was limited to rsETH and did not affect other apps or cross-chain assets.
LayerZero Labs published a post-mortem on the $292M KelpDAO attack, revealing attackers poisoned RPC infrastructure to forge cross-chain messages. The exploit relied on a 1-of-1 DVN setup. LayerZero will stop signing messages for such configurations and push projects to multi-DVN redundancy.
LayerZero published a joint post-mortem with Mandiant and CrowdStrike on the April 18 rsETH bridge exploit. North Korean hackers TraderTraitor used social engineering to breach a developer account, manipulated RPC nodes, and bypassed a single-verifier setup, draining 116,500 rsETH ($292M).
rsETH remained off-peg after the KelpDAO exploit, pressuring DeFi lenders and prompting Aave to freeze related reserves. Flare argues bridge security must be treated as a core part of collateral risk management.
Lombard has integrated its LBTC token into Eigenlayer, allowing Bitcoin holders to restake and secure AVS while earning dual rewards from Babylon and Eigenlayer, marking BTC's debut as collateral in Ethereum-based DeFi services.
LayerZero said the roughly $290 million rsETH exploit was limited to KelpDAO’s configuration, but critics argue the incident exposed deeper risks around validator centralization and infrastructure control in DeFi bridges.
KelpDAO's rsETH depegged following a suspected North Korean-linked hack, with over $70M stolen. Flare CPO Filip Koprivec argues bridge security must be integrated into collateral risk management. Flare is advancing FAssets v1.3 upgrades and expanding validator networks to address systemic DeFi risks.
