OP Labs introduced Privacy Boost, an SDK for adding confidentiality to any OP Stack chain. The release aims to help projects meet regulatory requirements such as MiCA, BSA, AML/KYC, and GDPR, which are difficult to satisfy when user transaction data is published on a public blockchain.

Privacy Boost combines zero-knowledge proofs with trusted execution environments, where ZK proofs ensure privacy and cryptographic integrity, while TEEs improve performance and simplify integration. Built on a UTXO-based model, the solution can generate proofs in under 500 milliseconds and includes a forced withdrawal feature. Privacy Boost is now live on OP Mainnet.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

The Arbitrum Security Council executed an emergency upgrade to freeze 30,766 ETH from an address involved in the KelpDAO exploit. As part of the recovery effort, $71 million in ETH was moved from the exploiter's wallet into a frozen intermediary address. The funds will remain frozen until an Arbitrum DAO vote approves further action.

Council member Patrick McCorry explained that the council briefly modified the chain's inbox contract on L1 to include a function enabling cross-chain messages that could impersonate any sender. Using this capability, a single transaction impersonated the exploiter's address to transfer the funds. Immediately afterward, the inbox contract was restored to its original state.

The Arbitrum DAO will need to decide how to allocate the recovered funds. It will need to determine whether to use them to compensate Aave users for losses or return them to KelpDAO to help restore rsETH backing.

Update (May 4, 2026): A U.S. law firm has filed a restraining notice in SDNY seeking to claim the frozen 30,766 ETH for its own clients, citing the exploit's attribution to North Korea's Lazarus Group. Aave LLC has filed an emergency motion to vacate the notice and is requesting a $300M bond if it stands. The DAO transfer vote remains legally blocked pending the court's decision.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

• KelpDAO $290m LayerZero bridge exploit.

• Aave freezes WETH and LST markets.

• Fluid aWETH Redemption Protocol.

• LayerZero RPC-poisoning attack.

• Eth.limo suffers nameserver hijack.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

KelpDAO suffered a $290 million exploit involving its LayerZero-powered cross-chain bridge. An attacker released 116,500 rsETH from the bridge contract on Ethereum mainnet without a corresponding burn on L2, representing roughly 18% of the rsETH circulating supply. The funds were used as collateral across Aave V3, Compound V3, and Euler to borrow an estimated $236 million in WETH. Read more →

Large depositors, including Justin Sun and MEXC, withdrew millions from Aave in the hours following the KelpDAO exploit. Aave disabled rsETH markets on V3 and V4, disabled WETH markets across Ethereum, Arbitrum, Base, Mantle, and Linea, and disabled borrowing on all LST and LRT collateral types. Aave's TVL has fallen by $8.4 billion since the rsETH exploit. Read more →

Fluid launched the aWETH Redemption Protocol, allowing Aave lenders to swap aWETH collateral for wstETH or weETH at a cost of approximately 2%. Fluid is able to offer the service because it operates a leveraged looping vault holding $144 million in Aave positions that it is looking to unwind. The solution currently only supports swaps on Ethereum mainnet. Read more →

LayerZero published a statement claiming the exploit stemmed from a sophisticated RPC-poisoning attack and attributed the incident to the TraderTraitor subgroup of North Korea's Lazarus Group. LayerZero Labs placed responsibility on KelpDAO's 1-of-1 DVN configuration and stated it will no longer support single-DVN setups. Read more →

Eth.limo, a Web2 gateway that enables ENS domains to be accessed over HTTPS, suffered a domain hijack on April 17, 2026. An attacker tricked the DNS registrar EasyDNS into carrying out a fraudulent account recovery, though DNSSEC contained an attack. Eth.limo plans to migrate to Domainsure, which eliminates account recovery options. Read more →

• Bitmine buys 101k ETH

• CoinCenter report on code is speech

• ENS IPFS hosted apps

• L2Beat interactive interop page

• Vercel suffers a data breach

• 26 protocols paused OFT

• Solidity survey results

• Privacy Cash live on Base

• Base agent market

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.