kelpdao

After KelpDAO was attacked, resulting in a loss of $292 million, the industry's scrutiny of the security of cross-chain infrastructure has intensified. Approximately $4 billion in assets have completed or are in the process of migrating from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP). The DeFi protocol Lombard is the latest project to join this migration trend. The protocol announced it would discontinue the use of LayerZero and migrate over $1 billion in Bitcoin-backed assets to Chainlink CCIP, stating that this decision stemmed from a comprehensive internal security review following the April attack incident.Lombard issues two types of Bitcoin-backed tokens—LBTC and BTC.b—and will prioritize the migration of assets on chains such as Solana, Etherlink, Berachain, Corn, and TAC, while terminating the use of LayerZero on Morph and Swell. Lombard stated that the reason for choosing CCIP is its independent node operators, built-in rate limiting mechanisms, and audited infrastructure. Additionally, the protocol will adopt Chainlink's cross-chain token standard to facilitate asset cross-chain circulation through a burn-and-mint model.Previously, Kelp DAO, Solv Protocol, Re, and the cryptocurrency exchange Kraken have all completed similar migrations, with these projects collectively transferring approximately $4 billion in assets. Chainlink Labs Chief Business Officer Johann Eid stated, "We are witnessing a continued wave of risk-averse migration within the industry."

According to CoinDesk, Aave Labs will rewrite the asset listing and collateral risk control rules. In addition to the existing price and volatility assessments, new reviews will be added for compatibility, network security, and underlying architecture, and minimum standard guidelines will be published for asset issuers.This move stems from the KelpDAO cross-chain bridge attack in April, where hackers minted approximately $293 million worth of unbacked rsETH and borrowed real wETH on Aave as collateral, resulting in hundreds of millions of dollars in bad debt for the protocol. Aave will also shift from a single pool perspective to studying systemic connections between different DeFi protocols to reduce cross-protocol risks and is calling on other DeFi projects to follow similar standards.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.

According to The Block, North Korea has denied allegations of its involvement in cryptocurrency theft, calling the claims "absurd defamation" and a "political tool." The statement was released by state media, emphasizing that necessary measures will be taken to safeguard national interests.However, data from blockchain analysis firm TRM Labs shows that hacker groups associated with North Korea have stolen approximately $577 million, accounting for about 76% of global cryptocurrency theft losses during the same period. This includes two major attack incidents on KelpDAO (approximately $292 million) and Drift Protocol (approximately $285 million).TRM pointed out that the related attacks are mainly associated with the Lazarus Group and its sub-organizations. Since 2017, the cumulative scale of cryptocurrency theft linked to North Korea has exceeded $6 billion. U.S. and international agencies generally believe that such funds are used to support military and missile programs. Meanwhile, the U.S. Treasury has recently imposed sanctions on related individuals and entities, involving approximately $800 million in illegal fund flows for 2024.

KelpDAO has announced that it has completed its committed contribution to the recovery fund and has provided 2000 ETH in treasury funds to the DeFi United recovery plan led by Aave, aimed at restoring the peg support for rsETH and promoting the system's return to normal operation.This funding is a one-time investment intended to restore rsETH to its nominal exchange rate. Following the events of April 18, DeFi United, in collaboration with multiple ecosystem participants (including Mantle, Consensys, Arbitrum, Lido Finance, LayerZero, etc.), has formulated a recovery path that includes re-capitalization of the bridging treasury, restoration of oracle functionality, and addressing funding gaps in the affected markets.Kelp stated that its investment helps accelerate the overall repair process. Kelp emphasized that the internal commitment before any public statement is that "rsETH holders will not be abandoned," and noted that this contribution is a direct manifestation of that commitment.As funds from various parties gradually come into place, the collateral support for rsETH will gradually return to normal, and the company will continue to update the community on progress.

The latest report from blockchain intelligence agency TRM Labs shows that approximately 76% of global cryptocurrency hacking losses are related to organizations associated with North Korea, with a total stolen amount of about $577 million.North Korea's share of global crypto theft continues to rise: 22% in 2022, 37% in 2023, 39% in 2024, rising to 64% in 2025, and further increasing to 76% in 2026. Since 2017, the total illegal profits have exceeded $6 billion. The report points out that these losses mainly stem from two major incidents in April: a $292 million attack on KelpDAO and a $285 million theft from Drift Protocol, with the two attacks accounting for about 3% of all hacking incidents during the same period.

According to The Block, Standard Chartered's latest report points out that the theft of KelpDAO's rsETH, while causing a severe impact on the DeFi ecosystem, is not enough to change the long-term growth trend of real-world asset (RWA) tokenization.Geoffrey Kendrick, head of digital asset research at Standard Chartered, stated that this incident is more like DeFi being "bent, not broken," and may even become an important turning point for the industry towards a more resilient structure.Standard Chartered maintains its forecast: by the end of 2028, the RWA tokenization market size will grow from $35 billion in October 2025 to $2 trillion, with the core driving force still coming from the continued expansion of the DeFi banking system and stablecoin liquidity.

Aave, in collaboration with multiple institutions, has launched the "DeFi United" rescue plan to address the approximately $292 million loss caused by the KelpDAO vulnerability attack and to prevent the spread of bad debts.The attack originated from a vulnerability in the LayerZero integration, where hackers forged uncollateralized rsETH and borrowed approximately $190 million in assets on Aave, leading to collateral distortion and triggering a bank run, causing the platform's TVL to evaporate by about $10 billion at one point.Currently, Lido Finance, EtherFi, and founder Stani Kulechov have proposed funding plans; Arbitrum has frozen some funds, but the remaining assets have been transferred through THORChain, making recovery difficult. The current focus is on joint funding to "patch the holes" and stabilize the DeFi lending system.

The on-chain analysis platform Santiment tweeted that six days after the Kelp event outbreak, there were obvious signs of "refugee trade" in the market.The Spark token SPK skyrocketed from $0.029 to $0.058 within 48 hours, an increase of over 100%. Meanwhile, whale transactions (over $100,000) surged from an average baseline of about 30 per day to 183 today.In contrast, the price of the AAVE token continues to decline, currently hovering around $92, even though Bitcoin had previously broken through $79,000 earlier this week.Santiment pointed out that this event did not solely cause destruction but led to a reallocation of funds— a liquidity crisis for one protocol turned into a bull market for another protocol.Note: "Refugee trade" is a metaphorical term in the crypto/DeFi space, specifically referring to the phenomenon where funds flee in large amounts from damaged or high-risk protocols, similar to refugees, and move to another protocol that is relatively safe and lower risk.

According to official news, KelpDAO stated that over the past few days, the team has been continuously advancing the handling of related events with the support of partners, allies, and the community. Discussions are progressing in a positive direction, and efforts are being accelerated to reach a suitable solution. The project party emphasized that it always adheres to the core principle of "user first," and subsequent measures will be gradually implemented with the aim of safeguarding the overall interests of users.In the past four days, the Kelp team has been working around the clock in collaboration with multiple parties, maintaining close communication with all relevant parties, and making substantial progress on several potential solutions. This includes measures taken by the Arbitrum Security Council to freeze the stolen funds, as well as SEAL 911 participating in the preliminary investigation to provide objective and clear analytical support for the incident.Kelp stated that the current focus of work remains on protecting user asset security and strengthening the protocol itself. This incident is not only of critical significance to the project but also has enlightening value for the entire industry. The team will continue to disclose subsequent progress through official channels and thanks the ecological partners and community for their ongoing support.Previous reports indicated that the KelpDAO hacker has essentially laundered $175 million in ETH into BTC.

According to on-chain analyst Yu Jin's monitoring, within a day and a half, the KelpDAO hacker has exchanged nearly all of the 75,700 ETH (175 million USD) for BTC.The hacker mainly used the THORChain protocol for cross-chain exchanges, contributing 800 million USD in trading volume and 910,000 USD in platform fee revenue to THORChain.

According to monitoring by Shield, the KelpDAO attackers have begun to transfer the stolen assets: they transferred some of the stolen ETH from the Ethereum mainnet across to Arbitrum via the Across Protocol, then exchanged it for USDT, and routed it to the TRON DAO ecosystem through LayerZero.This path shows that the attackers are diversifying and laundering funds through multi-chain bridges and stablecoin conversion methods, and the subsequent flow of funds still needs to be continuously tracked.

According to a Bloomberg report citing Jefferies, a hacker attack on small crypto projects over the weekend, involving nearly $300 million, and the subsequent $10 billion fund run at the largest decentralized lending platform (the KelpDAO and Aave incident), may weaken Wall Street's interest in blockchain technology.Andrew Moss, an analyst at Jefferies' digital asset research team, pointed out that over the past year, banks, asset management companies, and payment institutions have been developing blockchain products similar to the technology system exploited by North Korean hackers. The report suggests that while such incidents are unlikely to directly impact traditional financial markets, it warns that traditional financial institutions may pause related processes and reassess risks before further advancing blockchain business.

According to on-chain analyst Specter (@SpecterAnalyst), the North Korean hacker group TraderTraitor began laundering stolen funds from KelpDAO early this morning Beijing time, just three hours after the Arbitrum Council froze 30.7 ETH (approximately $71 million).The attackers split the remaining funds into three wallets, holding approximately 25,000 ETH (about $57.6 million), 25,700 ETH (about $59.2 million), and 25,000 ETH (about $57.9 million), with the third wallet immediately starting the laundering process, currently holding about 3,800 ETH (approximately $8 million). The funds are primarily being bridged to the Bitcoin network via THORChain, with about 99% of the funds flowing through this protocol, causing THORChain's trading volume to surge to $211 million that day, more than ten times its 30-day average, generating approximately $189,000 in fees.During this laundering process, the funds were also mixed with illicit proceeds from the BTC Turk (2025) and Bybit (2025) hacking incidents, with related funds currently tracked on the Bitcoin network totaling approximately 442 BTC (about $33 million), and the entire laundering process has utilized over 400 addresses.

On-chain investigator ZachXBT updated that the funds related to the KelpDAO attack have begun to be transferred, with approximately $1.5 million being cross-chain transferred from the Ethereum mainnet to the Bitcoin network via Thorchain, and another approximately $78,000 being transferred through Umbra.The initial source of funds for the related attack addresses came from Tornado Cash, and the money laundering and cross-chain transfers are still ongoing.

According to monitoring by PeckShield, the KelpDAO attackers have transferred 75,700 ETH to 2 new addresses.