Back En.Bloomingbit

LayerZero Says $290 Million KelpDAO Hack Is Suspected Lazarus Attack

En.Bloomingbit • April 20, 2026

LayerZero said a hack that drained $290 million from KelpDAO is preliminarily believed to be linked to North Korea’s Lazarus Group.

In a post on X on April 20, LayerZero said KelpDAO suffered an exploit that resulted in the loss of $290 million in assets. The company said the attack is tentatively tied to Lazarus, also known as TraderTraitor. LayerZero’s cross-chain bridge was the bridge used by the hacker in the exploit.

The attack targeted network infrastructure rather than a vulnerability in the protocol itself or stolen keys, according to LayerZero. The attacker poisoned the RPC, the communication path used by the decentralized verifier network, or DVN, to send transaction requests to the blockchain. It also launched a distributed denial-of-service, or DDoS, attack that pushed the system into recovery mode.

During that process, transactions that never actually occurred were verified as valid, leading to the asset outflow.

LayerZero identified KelpDAO’s "1/1 DVN" structure as the main cause of the incident. Because the setup relied on a single verifier, it created a single point of failure and left the system exposed to attack.

The impact was limited to rsETH, a restaking token, and did not spread across the broader protocol, it added. The affected RPCs have all been replaced, and LayerZero Labs’ DVN is operating normally.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Kelp DAO Exploit: $293 Million Drain Triggers DeFi Contagion On April 18, 2026, Kelp DAO's LayerZero-powered cross-chain bridge was exploited, resulting in the theft of 116,500 rsETH, valued at approximately $293 million. The attacker utilized a forged cross-chain message to trick the bridge into releasing the funds to an attacker-controlled address. This exploit represents about 18% of rsETH's circulating supply and has caused significant disruption across the DeFi ecosystem, impacting at least nine other platforms, including Aave, which froze its rsETH markets to prevent further losses. The stolen funds were quickly converted into ETH, raising concerns about the backing of rsETH on various networks. Kelp DAO has paused its contracts while investigating the incident and coordinating with security experts. The attack highlights vulnerabilities in cross-chain bridge infrastructure and the interconnectedness of DeFi protocols. 187 sources 66

Extracted Entities

LayerZero Says $290 Million KelpDAO Hack Is Suspected Lazarus Attack

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (1)

Countries (1)

Malware (1)

Platforms (1)