LayerZero published a statement claiming the $290 million KelpDAO exploit stemmed from a sophisticated RPC-poisoning attack that manipulated its DVN's verification process. It attributed the attack to the TraderTraitor subgroup of North Korea's Lazarus Group. According to LayerZero, the attackers compromised RPC nodes and fed forged data directly to the DVN while masking activity from monitoring systems.

LayerZero Labs placed responsibility on KelpDAO, arguing its 1-of-1 DVN configuration enabled the exploit, even though LayerZero's own DVN was the sole verifier KelpDAO relied on. LayerZero stated that it will no longer support single-DVN setups. The company also did not outline any intentions to compensate impacted users. Aave subsequently froze WETH and LST markets as the exploit rippled through DeFi.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

As the secondary shock of KelpDAO's $290 million exploit rippled through DeFi, large depositors including Justin Sun and MEXC withdrew millions from Aave. To mitigate impact, Aave disabled rsETH markets on V3 and V4, disabled WETH markets across Ethereum, Arbitrum, Base, Mantle, and Linea, and disabled borrowing on all LST and LRT collateral types.

Unable to withdraw from the frozen markets, users swapped their collateral to adjacent markets, sending the ETH, USDC, and USDT markets to 100% utilization. The stablecoin supply rates also surged above 13%. When markets are at 100% utilization, lenders are unable to withdraw, and many were stuck paying elevated interest on debt with frozen collateral. Aave's TVL has fallen by $8.4 billion in the last 48 hours. Fluid launched an aWETH redemption protocol offering stranded lenders a ~2% exit to wstETH or weETH.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.

KelpDAO, a liquid restaking protocol, suffered a $290 million exploit involving its LayerZero-powered cross-chain bridge. On April 18, 2026, at approximately 17:35 UTC, an attacker was able to release 116,500 rsETH from the bridge contract on Ethereum mainnet without a corresponding burn event on a Layer 2. The amount represents roughly 18% of the rsETH circulating supply.

The attacker exploited a single point of failure in KelpDAO's 1-of-1 Decentralized Verifier Network (DVN) configuration, in which LayerZero Labs' DVN acted as the sole verifier. The funds were quickly distributed across multiple wallets and used as collateral across Aave V3, Compound V3, and Euler, allowing the attacker to borrow an estimated $236 million in WETH. Aave is facing significant bad debt exposure, potentially exceeding $170 million across deployments.

Tensions between LayerZero Labs, KelpDAO, Aave, and users are escalating as attribution of the attack remains unconfirmed, with responsibility still disputed. LayerZero has since attributed the attack to North Korea's Lazarus Group. Aave froze ETH and LST markets in response, and Fluid launched an aWETH redemption protocol to help stranded lenders.

EarnUSD is a stablecoin vault by Lido for earning transparent, onchain USD-denominated rewards. Get started today at stake.lido.fi/earn

Disclaimer: Content is for informational purposes only, not endorsement or investment advice. The accuracy of information is not guaranteed.