kelp

KelpDAO stated on platform X that it has filed a lawsuit against LayerZero and its co-founder Bryan Pellegrino, seeking accountability for the rsETH cross-chain bridge attack incident that occurred earlier this year. The lawsuit claims that LayerZero failed to adequately disclose its inherent technical weaknesses and risks; failed to prevent its security infrastructure from being compromised; and that LayerZero had previously reviewed and approved Kelp's deployment and configuration in writing.Officials stated that LayerZero has publicly attributed responsibility to itself in recent months. Since the occurrence of the attack, the team has taken action to ensure the safety of user assets, including migrating the rsETH cross-chain bridge to a more secure cross-chain standard.LayerZero co-founder and CEO Bryan Pellegrino tweeted that KelpDAO's related claims lack basis and that he will respond and defend in Vancouver.Previously, LayerZero released an incident report indicating that on April 18, 2026, the KelpDAO rsETH cross-chain bridge built on LayerZero was attacked, resulting in a loss of approximately 116,500 rsETH, valued at around $292 million.

Kelp stated that the team detected potential suspicious activity from an address (0xc70f...0ea0) that received rsETH a few hours ago. As a precaution, a 24-hour wallet-level temporary pause has been implemented on this address, during which rsETH cannot be transferred in or out of the address.

According to on-chain detective ZachXBT's monitoring, it was found that signs of mixing appeared in the funds stolen from the Humanity Protocol and Kelp DAO vulnerability attacks one hour ago, indicating that there may be an overlap between the attackers of these two incidents.Based on this new evidence, it can be largely ruled out that the theft case of Humanity Protocol was committed by an insider.

According to The Defiant, approximately $220 million of unfrozen funds from the Kelp DAO cross-chain bridge attack has been almost entirely laundered by hackers. On-chain analyst Arkham Intelligence tracking shows that only about $1.7 million remains in the original attacker's wallet. This hacker is linked to North Korea and previously launched a $292 million cross-chain bridge attack on LayerZero in April.Funds were transferred using privacy tools such as THORChain, Wasabi, Tornado Cash, and Umbra. The approximately $71 million in Ethereum frozen by the Arbitrum security council on April 20 is currently the only recoverable portion. A report released by LayerZero on May 18 attributed the attack to the North Korean group TraderTraitor. Kelp has recovered approximately 116,000 rsETH by migrating to Chainlink CCIP and the DeFi United program, while the Aave security module absorbed about $190 million in bad debt.

Regarding the attack on the Kelp rsETH LayerZero V2 bridge that occurred on April 18, Aave released a post-incident investigation on the X platform, emphasizing that the exposure was primarily due to third-party bridge infrastructure rather than the protocol itself. The attacker executed an RPC poisoning attack targeting a single validator of LayerZero, forging a cross-chain message. This led to the release of 116,500 rsETH on the Ethereum side without actual destruction on Unichain. The attacker subsequently deposited the stolen rsETH into Aave V3 (Ethereum Core and Arbitrum), borrowing approximately 82,650 WETH and 821 wstETH.The Aave Protocol Guardian and Risk Steward immediately implemented protective measures for the rsETH and WETH reserves. Currently, the WETH and rsETH markets in the affected V3 deployments are operating normally. The rsETH held by the attacker on Arbitrum has been destroyed, the LayerZero OFT adapter has been fully recharged in five batches, rsETH support has been fully restored, and Kelp has reopened the withdrawal, bridging, and claims functions for rsETH. The WETH LTV in the affected markets has been reset to pre-attack values, and Aave V3 is fully operational across all markets except for rsETH.The Arbitrum DAO has voted to authorize the transfer of frozen ETH to Aave LLC, and it is currently awaiting on-chain execution. The court is still reviewing the substantive content of the injunction, and Aave LLC will continue to comply with the injunction during the court's deliberation. Ongoing projects include: the Aave risk framework from Llama Risk, the bridging assessment framework, the release of evaluation reports for currently live assets, on-chain execution of Arbitrum DAO votes, and the court's review of the injunction.

According to The Block, since the KelpDAO cross-chain bridge attack in mid-April, the total value locked (TVL) in DeFi has decreased by about 14%, from approximately $172 billion to $148 billion. The attackers exploited vulnerabilities in off-chain infrastructure rather than smart contract vulnerabilities, stealing about $292 million and exposing new infrastructure risks.The outflow of funds has continued for more than five weeks, indicating that investors are broadly withdrawing marginal capital rather than just targeting specific protocols that were attacked. Lending, as the largest DeFi category, saw its locked amount decrease from about $53 billion to $40 billion, marking the largest decline. Liquidity re-staking protocols also experienced significant drops. The KelpDAO attack indicates that as the security of smart contracts improves, off-chain infrastructure is becoming a more easily exploitable attack surface.

Kelp DAO announced on Monday that after losing $293 million due to an attack by North Korea's Lazarus Group on April 18, rsETH has been fully restored after five weeks of repairs. Kelp DAO stated that the final batch of 20,373.7 rsETH has been sent to the LayerZero smart contract responsible for cross-chain transfers, officially concluding the operational phase of the rsETH recovery plan.Multiple crypto protocols contributed funds through the DeFi United initiative to assist in restoring the support for rsETH. The first batch of 25,000 rsETH was transferred on May 13, and withdrawals were reopened the next day. Currently, minting, redemption, and reward operations are all functioning normally. This attack caused a chain reaction in the DeFi lending market, with the attacker borrowing WETH using a large amount of stolen rsETH as collateral on Aave, resulting in Aave incurring $190 million in bad debt. The TVL dropped from $26.4 billion to below $14 billion and has since remained in the range of $13.9 billion to $15.1 billion without showing signs of recovery. In April, there were 25 crypto hacking incidents, resulting in total losses of $630 million.

According to official news, KelpDAO stated that the last batch of 20,373.72 rsETH has been transferred to the rsETH OFT adapter earlier, thus completing the operational part of the rsETH recovery plan. KelpDAO also attached the relevant transaction information.

LayerZero Labs released a report on the KelpDAO attack incident, confirming that the KelpDAO rsETH cross-chain bridge built on its cross-chain communication protocol was attacked, resulting in the theft of approximately 116,500 rsETH (about $292 million). Several security agencies, including Mandiant, CrowdStrike, and independent researchers, attributed the attack to the North Korean-related hacker group TraderTraitor (UNC4899).The report indicates that the attack began on March 6, 2026, when the attackers used social engineering techniques to compromise a LayerZero developer account, obtain session keys, and infiltrate the RPC cloud environment, further contaminating internal RPC node data and manipulating return results to deceive monitoring systems and the decentralized verification network (DVN).LayerZero Labs officially announced that it will adjust its security strategy, including no longer allowing its DVN to act as the sole signer in a single validation configuration, while also rebuilding the affected cloud infrastructure and introducing short-term credentials, instant permission upgrades, and multi-party approval mechanisms to enhance security.

Kelp stated on platform X that it has collaborated with multiple DeFi protocols to complete the liquidation of the attacker’s positions, and the recovery process of rsETH has made significant progress. Among them, Compound has participated in coordination multiple times over the past four weeks and provided about 3,000 ETH in support, while jointly completing the liquidation with Aave, recovering a total of approximately 17,426.2 rsETH. Euler Finance has liquidated the attacker’s positions within its protocol and plans to return the excess ETH to the DeFi ecosystem fund.

Kelp announced on platform X that to ensure the security standards of rsETH and optimize network integration, cross-chain support for rsETH on multiple networks will be stopped after June 15. The affected networks include Optimism, Manta, Mode, Blast, Scroll, X Layer, zkSync, Zircuit, Swellchain, Hemi, Berachain, Sonic, HyperEVM, Unichain, TAC, Avalanche, Plasma Stable, MegaETH, Monad, and Movement.Kelp reminds users holding rsETH on the above chains that they need to bridge back to the Ethereum mainnet before June 15. After June 15, asset recovery can still be requested, but each address will need to pay a fee of 100 USDC. The specific process will be announced as the deadline approaches.

According to CoinDesk, after KelpDAO was attacked resulting in a loss of $292 million, the industry's scrutiny of the security of cross-chain infrastructure continues to heat up, with approximately $4 billion in assets having completed or currently migrating from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP).The DeFi protocol Lombard is the latest project to join this migration trend. The protocol announced it would abandon LayerZero and migrate over $1 billion in Bitcoin-backed assets to Chainlink CCIP, stating that this decision stemmed from a comprehensive internal security review following the April attack incident.Lombard issues two types of Bitcoin-backed tokens—LBTC and BTC.b—and will prioritize the migration of assets on chains such as Solana, Etherlink, Berachain, Corn, and TAC, while terminating the use of LayerZero on Morph and Swell. Lombard stated that the reason for choosing CCIP is its independent node operators, built-in rate limiting mechanisms, and audited infrastructure. Additionally, the protocol will adopt Chainlink's cross-chain token standard to achieve asset cross-chain circulation through a burn-and-mint model.Previously, Kelp DAO, Solv Protocol, Re, and the cryptocurrency exchange Kraken have all completed similar migrations, with these projects collectively transferring approximately $4 billion in assets. Chainlink Labs Chief Business Officer Johann Eid stated, "We are witnessing a continued wave of risk-averse migration within the industry."

Kelp announced on platform X that the rsETH protocol has fully resumed normal operation, and the related functions have been re-launched on the mainnet and all Layer 2 networks, with the overall system status restored to normal levels. The rsETH exchange rate has been updated, accounting for all staking reward earnings accumulated during the suspension period. Meanwhile, EIGEN rewards are now open for distribution to rsETH holders, covering the entire suspension period.In addition, the deposit and withdrawal functions have been restored on the mainnet and Layer 2 networks, and the rsETH asset support status has been fully restored to 100% backing. The official emphasized that the current rsETH has achieved complete and sufficient support on the mainnet and L2 networks, and all operational processes have returned to normal.

Aave stated that the first steps of the rsETH technical recovery plan have been completed, which includes the destruction of the rsETH held by the attacker on Arbitrum. In the coming days, stakeholders will gradually replenish funds to the LayerZero OFT adapter and restart rsETH-related operations in phases.Kelp previously stated that it has completed a series of rsETH endorsement recovery steps with Aave, planning to gradually inject 117,132 rsETH from the Aave Recovery Guardian and Kelp Recovery Safe into the LayerZero OFT adapter on the Ethereum mainnet.

According to CoinDesk, Aave Labs will rewrite the asset listing and collateral risk control rules. In addition to the existing price and volatility assessments, new reviews will be added for compatibility, network security, and underlying architecture, and minimum standard guidelines will be published for asset issuers.This move stems from the KelpDAO cross-chain bridge attack in April, where hackers minted approximately $293 million worth of unbacked rsETH and borrowed real wETH on Aave as collateral, resulting in hundreds of millions of dollars in bad debt for the protocol. Aave will also shift from a single pool perspective to studying systemic connections between different DeFi protocols to reduce cross-protocol risks and is calling on other DeFi projects to follow similar standards.

Lido released the latest updates on the Kelp security incident, stating that the Snapshot vote regarding the EarnETH first loss protection mechanism being below the 1% threshold has reached the quorum and been approved. The losses for EarnETH users will be fully covered by the Lido Earn first loss mechanism.The rsETH held by the attacker has been liquidated, and the related stETH has been transferred to the DeFi United rescue plan. In addition, the EarnETH treasury is expected to reopen shortly after the Kelp protocol resumes operations, at which point users will be able to conduct normal deposit and withdrawal operations. Lido emphasized that during the freeze period, the EarnETH and EarnUSD treasuries continue to generate returns. Currently, EarnETH users only need to wait for the brief unfreezing process to complete, and once the funds are restored, they will be compensated according to the first loss protection mechanism.

According to The Block, the on-chain lending platform Aave has completed the liquidation of the remaining rsETH positions of the Kelp DAO attacker as part of the previously announced recovery plan.The collateral obtained from the liquidation will be transferred to a multi-signature address "Recovery Guardian" managed by the DeFi United initiative, which is working to restore the asset backing of rsETH and compensate affected users. This process marks one of the final stages of the community's efforts to make up for the $292 million vulnerability loss.Aave previously noted that its liquidation required governance process support, specifically, Aave voted to temporarily manipulate the price of the rsETH oracle to cause losses on the attacker’s fraudulent positions. Aave stated that all adjustments will be fully restored after the liquidation is completed.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.