KelpDAO Bridge Breach Results in $292 Million Loss

KelpDAO's cross-chain bridge adapter, powered by LayerZero, was exploited on April 18. Attackers stole approximately $292 million in rsETH, which equals 116,500 rsETH. This amount represents roughly 18% of the token's circulating supply.

The breach occurred because the system relied on a single verifier (1-of-1 Decentralized Verifier Network) operated by LayerZero Labs. Attackers compromised LayerZero's internal RPC nodes and replaced binaries with counterfeit versions to feed false data to the verifier. They also launched a DDoS attack on external nodes to ensure the compromised nodes remained the sole source of truth.

KelpDAO's emergency multisignature team paused the core contracts at approximately 18:21 UTC, about 46 minutes after the attack started. This action prevented the theft of an additional 40,000 rsETH. Preliminary analysis links the attack to the TraderTraitor subgroup of North Korea's Lazarus Group.

The incident triggered over $10 billion in withdrawals across DeFi protocols, including Aave. To date, partial recovery efforts have retrieved approximately $71 million, which is about a quarter of the stolen funds.