📰 Full Story
Over the weekend of April 18–20, attackers drained roughly 116,500 rsETH — about $290–293 million — from liquid restaking protocol Kelp DAO by exploiting a LayerZero-powered cross‑chain bridge.
Security firms and LayerZero pointed to North Korea’s state‑linked Lazarus group (TraderTraitor) after attackers allegedly poisoned RPC nodes used by LayerZero’s decentralized verifier network (DVN), launched a DDoS to force failover to compromised nodes, and fed a forged cross‑chain message that authorised the transfers.
Kelp DAO paused rsETH contracts, blacklisted attacker addresses and said it had stopped further drains; LayerZero says Kelp’s single‑DVN setup created a single point of failure, a claim Kelp disputes, saying it followed documented defaults.
DeFi platforms moved quickly: Arbitrum’s Security Council froze 30,766 ETH (about $71 million) linked to the exploit and transferred it to a frozen wallet pending governance action; Aave froze rsETH markets.
Firms and analysts warn of contagion across lending and liquidity pools and are modelling potential bad‑debt scenarios if backing cannot be restored.






💬 Commentary