Kelp DAO Bridge Exploit

Attacker exploited bridge contract using Tornado Cash-funded address.

Attackers tricked Kelp's cross-chain bridge into releasing 116,500 rsETH, then deposited stolen tokens on Aave to borrow WETH.

Exploit in Kelp’s cross-chain bridging architecture led to massive fund drain and immediate freezes of rsETH markets.

Exploit of Kelp DAO's rsETH bridge due to single-signer vulnerability allowed minting of unbacked tokens.

Compromised single-signer setup in Kelp's rsETH bridge allowed unauthorized token minting.

The $293M Kelp DAO bridge exploit led to bad debt on Aave after attackers borrowed against stolen collateral.

The $292M KelpDAO bridge exploit triggered panic withdrawals, freezing markets, and a sharp decline in DeFi TVL.

Attacker exploited KelpDAO bridge to mint 116,500 unbacked rsETH, deposited them into Aave, and borrowed real ETH; Aave froze markets, triggering a withdrawal run.

Attacker exploited single‑verifier setup in Kelp’s LayerZero‑powered bridge to drain funds.

Compromised verification channel allowed attacker to fake withdrawal confirmations.

Attackers compromised LayerZero verifier servers via server poisoning, leading to unauthorized bridge withdrawals.

Hackers compromised two nodes tied to the LayerZero bridge, allowing them to mint 116,500 rsETH and borrow wETH on Aave.

Exploit of KelpDAO's LayerZero-powered bridge led to $292M loss; Arbitrum council acted on law enforcement input to freeze attacker funds.

The $292M Kelp DAO rsETH bridge exploit caused bad debt on Aave, leading to a bank run and 100% utilization lock-up.

Attackers exploited a single-validator bridge to mint unbacked tokens, then borrowed against them across lending platforms.

Kelp DAO's use of a single verifier on LayerZero enabled the exploit.

The article reports Aave deposit flight and bad debt following Kelp DAO exploit.

Following the Kelp exploit, Arbitrum Security Council froze exploiter's ETH; Aave seeks redirection to DeFi United fund.

Exploit of Kelp DAO's rsETH bridge due to configuration issue triggered $290M loss and Aave bad debt.

Coordinated relief effort surpasses $300M in contributions toward covering exploit losses.

The April 18 bridge hack that impacted rsETH on Aave triggered a broad recovery effort.

Kelp bridge released rsETH without burn on Unichain, leaving $293M in unbacked rsETH.

Recovery plan published following April 18 exploit that minted 116,500 unbacked rsETH.

Hack on KelpDAO and subsequent collateral borrowing on AAVE caused a bank-run dynamic.

Aave's emergency motion led to a court order modifying the restraining notice.

The incident was triggered by Lazarus Group hacking Kelp DAO on April 18, 2026.

The exploit was caused by a flawed cross-chain message verification on KelpDAO's bridge using LayerZero.

Exploit leveraged flaws in Kelp's LayerZero message verification, creating unbacked rsETH used as collateral.

LayerZero attributes exploit to Lazarus Group, who targeted RPC infrastructure to forge a cross-chain message.

Attacker tricked cross-chain messaging layer to release funds from bridge.

A single crafted message to the KelpDAO bridge released 116,500 rsETH to an attacker, who deposited it as collateral on Aave.

The exploit was caused by a configuration vulnerability in Kelp DAO's cross-chain verification layer, allowing an attacker to forge a message and drain rsETH.

Attacker forged a LayerZero cross‑chain message, tricking Kelp’s bridge into releasing rsETH to an attacker‑controlled address.

The freeze was implemented after the Kelp bridge exploit led to millions in bad debt on Aave and law enforcement input.