layerzero

The KelpDAO Exploit Aftermath: $290M+ Drained in Major DeFi Security Incident 
The DeFi sector is reeling from the largest exploit of 2026 so far, where Kelp DAO’s rsETH bridge was drained of roughly 116,500 rsETH (approx. $290M–$293M) on April 18–19, 2026.
Post-Exploit Updates & Key Takeaways:
Root Cause: The exploit was not a direct smart contract bug but a misconfiguration in KelpDAO's LayerZero cross-chain message verification (a "single-DVN" setup), allowing the attacker to mint unbacked tokens.Contagion Impact: Stolen assets were used to drain liquidity across major platforms, creating nearly $236M in debt positions on Aave, which was forced to freeze rsETH markets.Partial Recovery: Arbitrum’s Security Council and other partners have taken action, with $71 million in ETH already frozen in a collaborative recovery effort.Attacker Identification: LayerZero has preliminarily linked the exploit to the North Korean-backed Lazarus Group
Mantle Network Confirms Security
Mantle Network has announced its official bridge, underlying network, and core assets remain fully secure. LayerZero confirmed the vulnerability was isolated to KelpDAO’s configuration, not Mantle's infrastructure. Mantle is in active communication with Aave to support recovery efforts, with $204 million in core USD liquidity already returning to its ecosystem.
Trust in DeFi & Security Lessons
This incident marks the second ~ $280M+ exploit in April, highlighting critical systemic risks in bridge technology. The event forces a reevaluation of: 
Cross-Chain Risks: The reliance on external, third-party messaging providers.Collateral Standards: Protocols must demand higher security standards for accepted collateral. 
While this event shakes user confidence, the fast-acting, coordinated response from protocols and network security councils to isolate affected assets demonstrates resilience in DeFi's maturing security practices.
#KelpDAO #MantleNetwork #CryptoSecurity #LayerZero #DeFiSecurity

The KelpDAO exploit is not just another hack headline. It is a reminder that in cross-chain systems, the biggest risk is often not the asset itself but the trust assumptions sitting underneath it.
On April 18, KelpDAO’s rsETH bridge was exploited for roughly 116,500 rsETH, worth about $290M–$292M. LayerZero said the incident was isolated to Kelp’s 1-of-1 DVN setup and followed a compromise of RPC infrastructure relied on by its DVN.
The damage did not stop at the bridge.
The attacker used stolen rsETH as collateral on Aave, which pushed the fallout into lending markets. Aave froze rsETH and wrsETH markets and said the protocol itself was not hacked, but warned that the final bad debt outcome could still be severe. Public reporting now places potential bad debt at roughly $124M to $230M, depending on how losses are allocated.
That is the part people should pay attention to.
A bridge exploit became a lending problem. A configuration choice became a system-wide trust problem. This is what DeFi composability looks like under stress: one weak assumption upstream can travel fast and show up as liquidity pressure, frozen markets, and confidence loss somewhere else. Aave’s guardian response was fast, but the event still shows how difficult it is to contain risk once bad collateral enters a larger protocol.
Now the blame game is fully open.
LayerZero says Kelp’s single-verifier configuration created the single point of failure and says it had long recommended multi-DVN redundancy. Kelp disputes that version, arguing the 1-of-1 verifier setup was LayerZero’s own documented default and that no specific warning was given to change rsETH’s configuration.
Meanwhile, Arbitrum’s Security Council has already frozen 30,766 ETH tied to the exploit, worth around $71M, moving it into a wallet that now requires further governance action to move.
What stands out to me is this: the industry keeps talking about decentralization at the surface level, but incidents like this are really about where trust quietly concentrates. Not in slogans. In verifier setups. In RPC dependencies. In defaults that nobody revisits until they fail.
There is still no unified compensation plan, and that uncertainty may matter almost as much as the exploit itself. The technical breach was the first shock. The coordination response will decide the longer-term damage.
What do you think hurts DeFi more here: the exploit itself, or the fact that responsibility is still being disputed after the damage is already on-chain?
#KelpDAO #LayerZero #AAVE #CryptoSecurity #Ethereum