Breaches and incidentsBriefChecked against a primary source
KelpDAO rsETH: LayerZero-run RPC nodes poisoned to fake a burn
18 Apr 2026: about 116,500 rsETH (about USD 292M) released from KelpDAO’s LayerZero bridge contract on Ethereum against a burn on Unichain that never happened.
- Disclosed
What happened
- Root cause per Chainalysis, citing LayerZero: rsETH used a 1-of-1 DVN (LayerZero Labs DVN only). Attackers compromised two LayerZero-hosted internal RPC nodes and swapped their software, then DDoSed an external RPC node so the DVN failed over to the poisoned nodes. KelpDAO disputes the blame, saying the compromised verifier was LayerZero’s own infrastructure and the 1-of-1 setup was LayerZero’s onboarding default (CoinDesk).
- Attribution: LayerZero attributed it to North Korea’s Lazarus Group, TraderTraitor subgroup. Chainalysis reports it as “attackers linked to” Lazarus.
- Response: Kelp paused rsETH contracts, blacklisted addresses, engaged SEAL-911 and blocked a second forged packet for about 40,000 rsETH (about USD 95M). Arbitrum Security Council froze 30,766 ETH on 20 Apr. Secondary reports say much of the rsETH was posted on Aave, leaving large bad debt. rsETH later migrated to Chainlink CCIP.
Sources
- https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/
- https://www.coindesk.com/tech/2026/04/20/kelp-dao-claims-layerzero-s-default-settings-are-what-actually-caused-the-usd290-million-disaster
- https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/
This is a brief: a short, sourced summary from our incident tracking. Full advisories add commands to check whether you are affected.