NewsCompaniesFlawsGuides
Get the app
CriticalClosedUpdated

KelpDAO bridge loses US$292 million in rsETH theft; token backing subsequently restored

Attackers stole 116,500 rsETH from KelpDAO’s bridge using compromised LayerZero infrastructure. Backing has been restored, but holders of retired rsETH tokens should check Kelp’s official recovery guide before the June 2027 deadline.

What to do

If you hold rsETH, check your network and token contract against [Kelp’s official recovery guide](https://blogs.kerneldao.com/blog/recovering-rseth-from-sunset-networks), or ask your custodian to check. Eligible retired tokens have a 15 June 2027 deadline; contact [email protected] if unsure before transferring or burning anything. Kelp says it never messages first or asks for your seed phrase.

What’s happening

Attackers stole 116,500 rsETH, worth approximately US$292 million, from KelpDAO’s bridge on 18 April. The compromise began with a socially engineered LayerZero developer in March. Falsified blockchain data persuaded the bridge’s single verifier to approve a transfer that had never happened. This affected rsETH holders and lending services accepting it as collateral. Chainalysis reports that Kelp described the single-verifier setup as a deployment default, while LayerZero said it had recommended multiple verifiers. LayerZero rebuilt the compromised infrastructure and stopped its verifier operating alone. Its investigators attributed the attack to North Korea, with medium confidence in the specific TraderTraitor group. Arbitrum froze some proceeds, and ecosystem contributions helped restore rsETH backing by late May. Restored backing does not establish that all stolen proceeds were recovered; complete recovery remains unconfirmed in the reviewed sources. As of 3 November, Kelp says backing is safe, while eligible holders on retired networks still need to complete its recovery process.

What
Breach
Affects
KelpDAO rsETH cross-chain bridge using LayerZero
Fixed in
Nothing to patch
Since
18 Apr 2026
Closed
12 Oct 2026

Timeline

  1. Update

    Kelp updated recovery guidance following June network retirements and the 5 October move of Base, Mantle and Ink bridging to Chainlink CCIP. Eligible old rsETH remains recoverable until 15 June 2027 at 23:59 UTC; Arbitrum’s live rsETH is excluded.

  2. Update

    PublicAML published updated tracing of 75,700 ETH in attacker proceeds. It reported that much of the bitcoin obtained from those funds subsequently entered transactions that obscured further tracing.

  3. Update

    Kelp announced that the final 20,373.7 rsETH replenishment had completed the operational recovery plan, according to Cointelegraph. DeFi United contributions helped restore backing; withdrawals had reopened on 14 May.

  4. Update

    LayerZero reported replacing the compromised cloud environment and introducing stronger access controls. Its verification service now refuses to approve messages where it is the only required verifier.

  5. Update

    An Aave recovery proposal confirmed that Arbitrum’s Security Council had frozen 30,766 ETH linked to the attacker. It proposed a 25,000 ETH Aave treasury contribution towards the wider DeFi United effort to restore rsETH backing.

  6. Update

    KelpDAO’s bridge released 116,500 rsETH, worth approximately US$292 million, against a fabricated cross-chain message. Compromised LayerZero data servers misled the bridge’s sole verifier.

  7. Update

    Kelp paused contracts and blocked attacker addresses. Chainalysis reports that this stopped a further attempted withdrawal of 40,000 rsETH, worth approximately US$95 million.

  8. UpdateNothing to patch

    According to LayerZero’s later investigation, attackers tricked a developer into running malicious software and stole session credentials. This provided access to the infrastructure later used in the bridge theft.

Sources

  1. LayerZero Labs KelpDAO Incident ReportLayerZero · 20 May 2026
  2. LayerZero Labs KelpDAO Incident Report — full reportLayerZero · 18 May 2026
  3. Recovering rsETH from Sunset NetworksKelp / KernelDAO · 12 Oct 2026
  4. Inside the KelpDAO Bridge ExploitChainalysis · 23 Apr 2026
  5. [ARFC] rsETH Incident Funding UpdateTokenLogic / Aave governance · 24 Apr 2026
  6. Kelp DAO says rsETH restored 5 weeks after $293M protocol hackCointelegraph · 26 May 2026
  7. Kelp DAO hack, six months on: where the $292M wentPublicAML · 5 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS