Kelp DAO

What happened

On 18 April 2026 attackers stole about 116,500 rsETH worth roughly $292 million from liquid restaking protocol Kelp DAO's LayerZero-powered bridge, the largest crypto theft of 2026 so far.

Attackers reportedly compromised a LayerZero Labs developer in early March, poisoned internal RPC nodes and DDoSed external ones so the single verifying DVN read fake burn events, causing the bridge to release rsETH against burns that never happened; rsETH was configured with only one verifier. Kelp paused contracts to block a further $95 million theft, and the Arbitrum Security Council froze over 30,000 ETH of downstream funds. Chainalysis and multiple outlets attributed the attack to North Korea-linked actors, and the exploit triggered $6.2 billion of Aave withdrawals before a 'DeFi United' effort raised about 132,650 ETH to backstop bad debt; Kelp and LayerZero publicly disputed responsibility for the single-verifier configuration.