[CLSTR]
< Back to situations

This situation has concluded

It was preserved as a record on July 26; the timeline below shows how it unfolded, with sources. Get the briefing to follow the top situations still developing: three emails a week, sourced and in order.

[SITUATION] · [QUIET] · [TECHNOLOGY]

10 clusters · 35 sources · 36 days · First seen · Last updated

North Korean‑linked KelpDAO DeFi hack and recovery

Overview

In mid‑April 2026 the KelpDAO protocol’s cross‑chain bridge built on LayerZero was compromised. Attackers forged RPC messages, minting about 116,500 rsETH (roughly $292 million) and using the tokens as collateral across DeFi platforms. The breach was attributed to North Korea’s Lazarus Group, specifically a unit known as TraderTraitor, which exploited KelpDAO’s single‑validator bridge configuration.

The hack prompted immediate emergency actions: Arbitrum froze 30,766 ETH, and KelpDAO announced a migration of its rsETH token to Chainlink’s CCIP for a more robust multi‑validator setup. Parallel legal fights emerged in the United States, with Aave and the law firm Gerstein Harrow seeking to lift injunctions on the frozen Ether and arguing that the assets belong to unrelated third‑party users rather than the North Korean state.

Throughout May, KelpDAO and Aave executed a staged “exploit‑burn” and refill operation, destroying the attacker’s holdings and gradually restoring over 117,000 rsETH via multi‑signature wallets. By May 18, Aave had reinstated normal WETH borrowing limits, and on May 20 LayerZero issued a detailed incident report, rebuilding its infrastructure with a zero‑trust architecture and ending support for single‑validator bridges.

The final tranche of rsETH was transferred on May 25, completing the recovery phase and allowing KelpDAO’s minting, redemption and reward functions to resume fully. The episode highlights systemic risks in cross‑chain DeFi infrastructure and has spurred industry‑wide calls for stricter security designs.

Timeline

  1. [TECHNOLOGY] 2 sources
    North Korean Lazarus Group Hacks KelpDAO Bridge, Steals $292M in DeFi

    Lazarus Group stole $292 million from KelpDAO’s bridge on April 18 2026, triggering a $13 billion DeFi value‑lock plunge and exposing single‑verifier risks.

  2. [TECHNOLOGY] 2 sources
    Kelp DAO restores 116k rsETH after $292M exploit

    Kelp DAO completed its rsETH recovery, sending the final 20,373.72 rsETH to the LayerZero adapter and restoring full protocol functionality; Aave confirmed markets are normal.

  3. [TECHNOLOGY] 2 sources
    LayerZero reports $292M loss in KelpDAO bridge hack

    LayerZero reports $292 M rsETH stolen from KelpDAO bridge via compromised RPC nodes; it will ban 1‑validator setups.

  4. [TECHNOLOGY] 4 sources
    Aave restores WETH borrowing after Kelp DAO exploit

    Aave reinstates WETH collateral rates on six chains after the April Kelp DAO bridge exploit, restoring borrowing limits.

  5. [TECHNOLOGY] 4 sources
    Kelp DAO Restores rsETH Tokens After $293 Million Hack

    Kelp DAO and Aave have burned the hacker’s rsETH and begun a $278 M refill, restoring the token after a $293 M Lazarus Group exploit.

  6. [CRIME] 7 sources
    North Korean hackers drive $2.1 B crypto theft as violent kidnappings hit investors

    North Korean hackers stole $2.1 B in crypto, while violent kidnappings and a $292 M DeFi hack underscore a surge in crypto crime.

  7. [TECHNOLOGY] 7 sources
    KelpDAO Migrates rsETH to Chainlink After $292 Million LayerZero Exploit

    KelpDAO shifts rsETH to Chainlink after a $292 M LayerZero breach blamed on a single‑verifier flaw.

  8. [TECHNOLOGY] 14 sources
    Arbitrum DAO faces US legal battles over frozen Ether from North Korea-linked hacks

    Aave and a U.S. law firm sue to block the release of frozen Ether tied to North Korea‑linked DeFi hacks on Arbitrum.

  9. [CRIME] 2 sources
    North Korean-linked hackers steal about $290 million in crypto, firm reports

    North Korean-linked hackers allegedly stole about $290 million in crypto from the KelpDAO exchange over the weekend, per a blockchain firm.

  10. [CRIME] 2 sources
    Kelp DAO Hack Triggers $292M Theft and 30,766 ETH Freeze, Arbitrum Activates Emergency Measures

    Kelp DAO hack moves $292M in rsETH and 30,766 ETH is frozen; Arbitrum deploys emergency measures as governance acts.

Sources

activistpost.com · aktiencheck · ambcrypto.com · bitcoinethereumnews.com · blog.bitfinex.com · canceractive.com · coinacademy.fr · coinfomania.com · coinpaper.com · cointelegraph.com · criptoinforme.com · crypto-economy.com · cryptobriefing.com · cryptonews.com.au · cryptonewsz.com · cryptoninjas.net · cryptoSlate.com · decrypt.co · en.bitcoinsistemi.com · en.coin-turk.com · ethnews.com · eyeos.org · financial-news.co.uk · focus · globalcryptopress.com · intomore.com · news.bitcoin.com · newsbtc.com · portaldobitcoin.uol.com.br · skoob.com · therogueginger.com · ubercanada2023.publicfirst.co · upi · valoya.com · zazoom