Kelp DAO
From Invertopedia, the encyclopedia of how things fail
Kelp DAO is a liquid restaking protocol that issues the rsETH token[2]. On April 18, 2026, attackers drained 116,500 rsETH, about $292 million, from its LayerZero-powered bridge[1][2]. That was roughly 18% of the token's circulating supply[1]. Kelp responded about 46 minutes after the drain, and Aave froze its rsETH markets[3].
What happened
| Apr 18, 2026 | The attacker calls lzReceive on LayerZero's EndpointV2 contract and moves 116,500 rsETH.[3] |
|---|---|
| 46 min later | Kelp responds to the incident. Two attempts to transfer 40,000 rsETH are reported.[3] |
| Apr 20, 2026 | Kelp disputes LayerZero's post-mortem, which blames Kelp for a 1-of-1 verifier setup.[2] |
The kill shot
Only one verifier had to approve a cross-chain message, so feeding that verifier false data was enough to forge one.
The attackers compromised RPC nodes the verifier used and injected falsified blockchain data through them[1]. Kelp says the single-verifier setup was LayerZero's onboarding default[2].
The inversion
A bridge is only as strong as its weakest required signer. Require more than one independent verifier.
References
- ^ “KelpDAO Loses $290 Million in Cryptocurrency to Hack, Incident Linked to Lazarus Group”. Hackmag, April 2026. Date, amount, 18% of supply, RPC poisoning and DDoS, preliminary Lazarus attribution.
- ^ “Kelp DAO claims LayerZero's 'default' settings are what actually caused the massive $290 million disaster”. CoinDesk, April 20, 2026. What Kelp is, the 1-of-1 setup and the blame dispute.
- ^ “Kelp Protocol Loses $293 Million Following Cross-Chain Bridge Attack”. ForkLog, April 19, 2026. The drain call, the 46-minute response, cancelled follow-ups and the Aave freeze.