Kelp DAO Loses $292 Million in rsETH Bridge Attack as LayerZero Points to Setup

For the second time this month, decentralized finance has a new record for the year’s biggest hack. On Saturday, an attacker drained 116,500 rsETH, worth about $292 million, from the bridge that liquid restaking protocol Kelp DAO uses to move its token between blockchains. The loss tops the roughly $285 million taken from Solana exchange Drift Protocol on April 1, and its effects quickly spread to lending markets across Ethereum.

On Sunday, LayerZero, the cross-chain messaging network behind the bridge, published its own account of the incident. It says its protocol worked as intended, blames the way Kelp configured its bridge, and suggests North Korean hackers were likely responsible.

Forty-six minutes to hit pause

According to CoinDesk, the drain took place at 17:35 UTC on Saturday. The attacker managed to convince Kelp’s LayerZero-powered bridge that a valid instruction had arrived from another network, and the bridge released 116,500 rsETH to an attacker-controlled address. That is roughly 18% of the token’s circulating supply of about 630,000.

Kelp’s emergency multisig paused its core contracts at 18:21 UTC, 46 minutes later. The pause appears to have mattered. The Block reports that two follow-up attempts at 18:26 and 18:28 UTC, each seeking another 40,000 rsETH worth around $100 million, failed because the contracts were already frozen. Had they gone through, total losses would have approached $391 million.

Kelp’s first public statement came at 20:10 UTC, nearly three hours after the drain. The team said it had identified suspicious cross-chain activity, paused contracts on Ethereum and several layer-2 networks, and was working with LayerZero, Unichain, its auditors and outside security experts. On-chain investigator ZachXBT noted that the attacker’s wallets had been funded through Tornado Cash about ten hours before the attack.

Aave and other lenders scramble

The damage did not stay inside Kelp. rsETH is widely used as collateral in DeFi lending markets, and the attacker used stolen tokens to borrow from them. Rather than selling the rsETH, the attacker reportedly deposited a large share of it on Aave as collateral and borrowed ETH against it. If that rsETH turns out to be underbacked, Aave could be left holding bad debt, and the protocol said it was reviewing rsETH borrows made after the exploit.

Aave froze rsETH markets on its V3 and V4 platforms within hours. Founder Stani Kulechov stressed that Aave’s own contracts were not compromised. Aave initially said its Umbrella safety module could cover any shortfall, then edited that statement to say it would “explore paths to offset the deficit.” The AAVE token fell about 10%.

Other protocols moved quickly too. SparkLend, Fluid and Upshift froze rsETH-related markets. Lido paused deposits into its earnETH product while saying stETH and wstETH were not affected, and Ethena temporarily paused its LayerZero bridges from Ethereum as a precaution despite saying it had no rsETH exposure.

There is also a wider question about rsETH itself. The Ethereum bridge held the reserve backing wrapped rsETH on more than 20 networks, including Base, Arbitrum, Linea and Scroll. With part of that reserve gone, holders on those networks face uncertainty about what their tokens are backed by.

LayerZero blames a single verifier

In a statement published Sunday, LayerZero described the attack as RPC poisoning rather than a flaw in its protocol or key management. It says the attacker compromised two of the RPC nodes, the servers that relay blockchain data, used by its own verifier service, swapping in modified software that showed the verifier a forged message while reporting accurate data to everyone else. The attacker then knocked the healthy nodes offline with a denial-of-service attack so the verifier would rely on the poisoned ones.

The key detail, according to LayerZero, is that Kelp’s rsETH bridge used a one-of-one setup, with LayerZero Labs as its only verifier. With no second, independent verifier to cross-check the message, the forged instruction went through. LayerZero says it had recommended that Kelp use multiple verifiers and that a multi-verifier setup would have stopped the attack. It added that it will no longer sign messages for any application using a one-of-one configuration and is contacting those projects to migrate.

LayerZero also said that preliminary indicators point to “a highly-sophisticated state actor, likely DPRK’s Lazarus Group,” specifically the TraderTraitor unit. That attribution is preliminary, and Kelp has not yet published its own root-cause analysis.

Why it matters

Two hacks of nearly $300 million each within three weeks will sharpen scrutiny of DeFi security, especially the parts of the system that sit between blockchains. Bridges have long been a favorite target because they hold large pools of assets backing tokens on other networks, and this attack shows how a single weak link in that chain can ripple through lending markets.

The incident also raises questions that go beyond Kelp. If one-of-one verifier setups were available and in use, other applications may carry similar risks. LayerZero’s decision to stop supporting them is a direct response, but the dispute over who chose the configuration is likely to continue as both sides publish more detail.

For users, the most immediate concerns are whether Aave and other lenders end up absorbing losses, and how Kelp plans to restore backing for rsETH across the networks where it trades.