KelpDAO Bridge Exploit

Analysis conducted from public and on-chain sources: LayerZero incident statement, Chainalysis forensic report, FBI IC3 PSA ic3.gov/psa/2025/psa250226, Aave governance records, and on-chain transaction data for the affected markets. Attribution marked preliminary where not confirmed by law enforcement.

Where a figure derives from a governance vote or external estimate rather than a directly read on-chain position, it is labelled as such. Unverified items are stated explicitly in Open Questions rather than omitted.

• 2026-03-06 · J-43Social-engineering phase begins. Attacker gains initial access to RPC node operator infrastructure.
• 2026-04-18 · 17:35 UTCDDoS and binary injection on 2 independent DVN node operators. RPC poisoning enables attacker-controlled message attestation on the 1-of-1 DVN path.
• 2026-04-18 · 17:35–18:21 UTCActive drain window — $292M in rsETH exposed via manipulated messages. No DVN private key compromised. (Duration cited as 46 min in published FC statement; not confirmed in primary sources.*)
• 2026-04-18 · ~17:40 UTCStolen rsETH deployed as collateral in Aave V3. Bridge integrity failure converts to lending-market solvency event.
• 2026-04-18 · 18:52 UTCAave Guardian freezes rsETH and wrsETH markets across all deployments. WETH frozen on several deployments as protective measure.
• 2026-04-18 · post-eventAave Arbitrum freezes 30,766 ETH. Bad debt modelled at $62.4M (uniform socialisation) to $162.5M (layer-isolated scenario).

The root cause was architectural concentration at the application-security layer. KelpDAO's rsETH bridge was configured with a 1-of-1 DVN: the LayerZero Labs DVN was the sole required attestor for destination-side message execution. In a modular-security system, that choice collapses the effective security budget of the application to the operational integrity of one verification path.

The attack did not exploit a vulnerability in the LayerZero core protocol, nor did it compromise any DVN private key. The vector was operational: DDoS and binary injection on two independent RPC node operators simultaneously, enabling the attacker to control which messages the single DVN attested.

Source: layerzero.network/blog/kelpdao-incident-statement

Any bridge using a 1-of-N DVN configuration where N=1 carries equivalent exposure. The structural fix is requiring M-of-N attestation with independent operators across distinct infrastructure.

The second-order impact exceeded the direct bridge loss in systemic significance. The attacker deployed stolen rsETH as collateral in Aave V3 across multiple deployments, borrowing ETH against assets that had no valid backing. This transformed a bridge accounting failure into a lending-market insolvency problem external to the exploit transaction itself.

Aave's rsETH and wrsETH markets were frozen at 18:52 UTC — approximately 76 minutes after the first exploit transaction. The lag between bridge drain and lending-market response represents the window during which unbacked rsETH was treated as valid collateral by on-chain lending logic.

The incident demonstrated a specific weakness of the LRT stack: an LRT such as rsETH carries layered dependencies on bridge message integrity, unified-supply accounting, and redemption ordering. During a crisis, each additional layer widens the gap between apparent and actual recoverable value.

1. LayerZero incident statement — layerzero.network/blog/kelpdao-incident-statement
2. Chainalysis forensic report — chainalysis.com/blog/kelpdao-bridge-exploit-april-2026
3. FBI IC3 PSA Lazarus Group — ic3.gov/psa/2025/psa250226
4. KelpDAO official statement — x.com/KelpDAO/status/2051755467328913637
5. On-chain transaction data — Etherscan