KelpDAO bridge exploit released ~$292M in rsETH through a non-existent burn mechanism, according to Chainalysis analysis.
Security & Exploits ·
On April 18, 2026, attackers associated with North Korea's Lazarus Group stole approximately $292 million in rsETH from KelpDAO's LayerZero bridge, bypassing smart contract logic entirely. Rather than exploiting code vulnerabilities, the attackers compromised internal RPC nodes and launched denial-of-service attacks on external nodes to feed false data to KelpDAO's verification infrastructure—a single-point-of-failure setup relying on one Decentralized Verifier Network with no independent backup. This allowed the Ethereum contract to release 116,500 rsETH based on a phantom token burn that never occurred on the source chain.
The exploit left no obvious on-chain traces; transactions appeared valid and signatures checked out, which is why traditional security monitoring failed to flag the activity. Cross-chain invariant monitoring—continuously verifying that tokens released on a destination chain match tokens burned on the source chain—would have been necessary to catch the discrepancy. The Arbitrum Security Council, working with law enforcement, froze over 30,000 ETH of attacker funds within three days, while KelpDAO paused its contracts to prevent a reported second theft of $95 million.
It remains unclear whether LayerZero's recommendation for multi-DVN configurations was adopted industry-wide after this incident, or whether similar single-point-of-failure setups persist elsewhere in cross-chain infrastructure.