KelpDAO's $290 Million Crypto Theft Spreads to Lending Markets as North Korean Hackers Are Suspected

A Forged Message, 116,500 Tokens and Billions at Risk

Attackers stole 116,500 rsETH tokens from KelpDAO on April 18, 2026, in a cryptocurrency theft valued at approximately $290 million, with the tokens worth roughly $293 million at the time of the attack. By April 22, the consequences had spread across decentralized lending markets, prompting emergency freezes, billions in withdrawals and a public dispute over who was responsible for the security settings that allowed the theft.

LayerZero Labs, the provider of infrastructure that lets assets move between blockchains, attributed the attack to TraderTraitor, a specialized unit within North Korea's Lazarus Group. Its assessment rested on preliminary technical indicators pointing to a sophisticated operation sponsored by a state.

The KelpDAO theft was the largest cryptocurrency heist recorded in 2026. It came only weeks after the same threat actors allegedly stole $285 million from Drift Protocol, bringing the amount attributed to North Korean hackers in April alone to more than $575 million.

KelpDAO's losses quickly became a problem for other businesses because rsETH was accepted as collateral, an asset pledged to secure a loan. The attackers deposited stolen tokens into Aave and borrowed other cryptocurrency against them. Users then rushed to withdraw their own funds, putting pressure on lending pools far beyond the original target.

Arbitrum's Security Council froze approximately 30,766 ETH worth $71 million, about a quarter of the stolen value. Most of the funds remained under the attackers' control. Funds were also laundered through Tornado Cash, a cryptocurrency mixing service designed to make transaction trails harder to follow.

What KelpDAO's rsETH Represents

KelpDAO is a decentralized finance protocol built on Ethereum. Decentralized finance, often shortened to DeFi, uses blockchain applications to provide services such as lending and trading. KelpDAO lets users deposit Ethereum and receive rsETH, a token representing assets committed to earning staking rewards.

Staking means committing cryptocurrency to support a blockchain's operations in exchange for rewards. KelpDAO also uses EigenLayer, an infrastructure service on Ethereum that allows those committed assets to support further services, a process called restaking. The rsETH token represents that position while remaining usable in other decentralized applications.

LayerZero provides the interoperability infrastructure through which rsETH can move between blockchain networks. This gives users more places to use their holdings, but each transfer depends on a system that can reliably verify information coming from another network.

A cross-chain transfer requires the receiving network to trust that the corresponding event happened on the sending network. In this attack, the thieves manipulated that verification step. A fraudulent message was accepted as genuine, allowing rsETH to be released to wallets controlled by the attackers.

KelpDAO's application code was not the point of entry described in the attack account. The thieves targeted the infrastructure supporting verification, exploiting the way the system obtained and trusted blockchain data. That made the security of the connections between networks central to the theft.

How the Attackers Poisoned Verification

The attackers targeted a Decentralized Verifier Network, or DVN, which checks messages moving between blockchains. They compromised specific Remote Procedure Call nodes, known as RPC nodes. These are communication endpoints through which applications request information from a blockchain.

The compromised nodes supplied falsified data to the verification layer. At the same time, the attackers launched distributed denial-of-service attacks against legitimate RPC nodes. Such attacks overwhelm a service with traffic, making it difficult or impossible for that service to answer normal requests.

With trusted endpoints struggling to respond, the verification system relied on compromised nodes serving false information. The attackers thereby persuaded it to accept a message describing an underlying transaction that had never happened on the blockchain.

KelpDAO's configuration required approval from only one DVN. This arrangement, described as a 1/1 configuration, created a single point of failure: once that verifier accepted the fabricated information, no independent verifier was required to challenge it.

The attackers also used a custom payload designed specifically to forge a message to the DVN while generating minimal warnings. The combination of compromised data endpoints, disrupted legitimate services and a single required verifier enabled the unauthorized transfer of rsETH.

LayerZero and KelpDAO Dispute Responsibility

LayerZero released a detailed technical postmortem describing the RPC spoofing method. The company said KelpDAO's decision to use one verifier caused the incident, despite earlier recommendations to use multiple independent DVNs. LayerZero maintained that requiring agreement among independent verifiers would have stopped this attack.

LayerZero described its position on KelpDAO's configuration and the advice it said had been given:

Operating a single-point-of-failure configuration meant there was no independent verifier to catch and reject a forged message. LayerZero and other external parties previously communicated best practices around DVN diversification to KelpDAO. Despite these recommendations, KelpDAO chose to utilize a 1/1 DVN configuration.

KelpDAO disputed that account of responsibility. It said it had operated on LayerZero infrastructure since January 2024 and maintained open communication with the LayerZero team. According to KelpDAO, questions about DVN configuration arose during its expansion onto Layer 2 networks, and the default settings were affirmatively confirmed as appropriate at that time.

KelpDAO argued that LayerZero's defaults helped create the vulnerable configuration. Its objection concerned whether a customer should bear full responsibility for security parameters presented as standard options, particularly when the customer says it discussed those settings with the infrastructure provider.

LayerZero asserted that there was zero contagion to other cross-chain assets or applications using different configurations. It also announced that it would stop signing messages for applications using a single verifier. That statement concerned other cross-chain configurations; lending platforms holding rsETH were already facing financial exposure from the stolen tokens.

David Schwed, chief operating officer at blockchain security firm SVRN, argued that a configuration identified as unsafe should not be shipped as an available option. His observation focused the dispute on secure defaults: whether protection should depend on users reading documentation and manually selecting stronger settings.

How Stolen Tokens Became a Lending Crisis

Aave, one of the largest decentralized lending protocols, registered a nearly $8 billion decline in total value locked as investors withdrew assets. Total value locked is the value of assets held in a protocol. A fall of that size showed how quickly users sought to reduce their exposure after the theft.

Aave froze rsETH markets across Ethereum, Arbitrum, Base, Mantle and Linea to prevent further exposure. The attackers had deposited stolen rsETH into Aave v3 as collateral and borrowed wrapped Ether, creating approximately $195 million in debt on the platform. Wrapped Ether is a token form of Ether that can be used within compatible applications.

The borrowing converted stolen collateral into liquid assets while leaving a lending platform exposed to the value of the pledged rsETH. As users rushed to withdraw, Aave v3 lending pools reached full utilization. In simple terms, the available assets were already lent out, temporarily preventing access to more than $5.1 billion in stablecoins.

Compound and Euler also reported effects from the incident and introduced emergency measures to limit the spread. Cardano founder Charles Hoskinson, discussing the exploit during a livestream, separated the initial bridge theft from the subsequent damage across lending markets.

Hoskinson said the unusual feature was how the attackers used stolen rsETH to borrow liquid assets. That turned the bridge forgery into a balance sheet crisis affecting at least nine protocols. The assets accepted as loan security became the route through which the original theft reached other platforms.

For depositors, the immediate problem was access to funds. For lending protocols, it was the quality of the collateral supporting outstanding loans. Those pressures developed together, with withdrawals reducing available liquidity while the stolen tokens supported substantial borrowing.

Market Turmoil and the April Timeline

The rsETH token traded between $1,600 and $2,500 during the first 24 hours as liquidity providers withdrew support. Those providers supply assets that help others trade; when they pull back, transactions can become harder to execute at stable prices.

Total value locked across DeFi fell by roughly $13 billion in the 48 hours following the incident. That broader decline accompanied Aave's nearly $8 billion reduction, showing how concern spread beyond KelpDAO's own holdings into the interconnected lending and trading market.

Arbitrum's Security Council froze approximately $71 million in ETH. Compared with the roughly $290 million stolen, that was about one quarter of the value involved, leaving most of the theft outside the freeze. Tornado Cash was used to obscure the movement of stolen funds, with the account of the incident describing much of the money as laundered through the service.

The main dates and intervals show how quickly the crisis developed:

• January 2024: KelpDAO began operating on LayerZero infrastructure, according to KelpDAO.
• Weeks before April 18, 2026: TraderTraitor was alleged to have stolen $285 million from Drift Protocol.
• April 18, 2026: Attackers drained 116,500 rsETH from KelpDAO, worth roughly $293 million.
• The first 24 hours: rsETH traded between $1,600 and $2,500 as liquidity providers pulled support.
• The following 48 hours: Total value locked across DeFi fell by roughly $13 billion.
• By April 22, 2026: Aave had frozen affected markets, LayerZero and KelpDAO had disputed responsibility, and Arbitrum's Security Council had frozen approximately $71 million.

No timetable for returning funds to affected users had been given by April 22. The freeze, emergency market restrictions and public statements were the concrete responses described at that point.

Why North Korea Is Suspected

LayerZero identified TraderTraitor, a subgroup within Lazarus known for targeting cryptocurrency platforms, as the suspected attacker. The preliminary attribution connected KelpDAO's loss to a broader pattern of theft sponsored by North Korea to evade international sanctions and fund weapons development.

A United Nations panel previously estimated that North Korea had stolen more than $3 billion in cryptocurrency since 2017. United Nations monitors have documented the use of these illicit proceeds to help finance nuclear weapons and ballistic missile programs.

TraderTraitor has been linked to multiple major thefts, including the $1.5 billion Bybit heist described in the April 22 account as occurring earlier in 2026 and as the largest cryptocurrency theft in history. The alleged $285 million Drift Protocol attack added to concerns that April's incidents formed part of a continuing campaign.

Henri Arslanian, co-founder of Nine Blocks Capital Management, expressed certainty about who was responsible. He said:

No other group globally has the expertise and muscle power to conduct such a hack

Arslanian pointed to the technical sophistication and operational security of the KelpDAO attack as matching capabilities associated with a state. The assessment also cited Tornado Cash laundering and an operation involving infrastructure compromise and social engineering elements.

The attack method reflected a shift from opportunistic exchange attacks toward patient intrusions into DeFi infrastructure. Rather than relying on a flaw in a smart contract or the theft of a private key, the attackers manipulated the services used to establish whether a cross-chain message was genuine.

A Campaign That Learns From Each Theft

Alexander Urbelis, chief information security officer at ENS Labs, described the incidents as a sustained cadence of operations. He argued that groups such as Lazarus use stolen resources to expand their tools, refine their methods and reinvest in further campaigns.

Urbelis described adversaries capable of combining weaknesses across several parts of a system:

These environments are not being tested by smash and grab actors, they are being pressured by disciplined adversaries who understand how to chain together weak points across infrastructure, applications, and trust relationships.

Cross-chain and restaking infrastructure connects networks and applications that hold substantial value. These layers are technically complex and harder to monitor than applications at the surface. The KelpDAO attack showed how knowledge of those connections could be used to corrupt the information on which other systems rely.

The operation combined several steps: controlling data endpoints, disrupting legitimate alternatives, forging a verification message, transferring tokens and borrowing liquid assets against those tokens. Each step exploited a different dependency, allowing the consequences to extend from a verification service into lending markets.

Hoskinson argued that a configuration requiring three of five verifiers to agree, rather than one of one, would have blocked the forgery. His criticism focused on verification logic and on the dependencies created by complex cross-chain activity in the Ethereum ecosystem.

Justin Sun Appeals for Negotiations

Justin Sun, the billionaire founder of the Tron Network, publicly asked the hackers to return the money and offered to negotiate. His intervention reflected concern that the theft could damage both KelpDAO and Aave rather than remain a loss confined to one protocol.

Sun addressed the attacker on social media and proposed talks with KelpDAO involved:

Kelp DAO hacker, how much you want? Let's talk. With Kelp DAO's help, of course. It's simply not worth it to sacrifice both Aave and Kelp DAO and let them go down over this hack. You can't spend $300 million anyway.

Addresses linked to HTX, the exchange owned by Sun, had sent hundreds of millions to accounts on Aave. That exposure added a financial context to his public appeal as users and platforms sought to contain the damage.

Security professionals advocated zero-trust architectures, an approach that assumes parts of a system may be compromised and requires strict checks rather than automatic trust. The recommended protections included stronger RPC endpoint security, agreement among multiple independent verifiers, defenses against denial-of-service attacks and circuit breakers that automatically pause transactions when unusual activity is detected.

LayerZero's decision to stop signing messages for applications using one verifier addressed the configuration at the center of the dispute. Schwed's argument about unsafe options addressed an earlier stage: whether a vulnerable setting should be available to select in the first place.

KelpDAO's theft brought those two questions together with the financial consequences of accepting assets across connected protocols. Decentralization depends on practical choices about who verifies information, how many independent checks are required and what happens when a component fails. In this case, one corrupted verification process opened a route to hundreds of millions in stolen tokens and much larger disruption across lending markets.

The Essentials

• Attackers stole 116,500 rsETH from KelpDAO on April 18, 2026, a theft described as approximately $290 million, with the tokens valued at roughly $293 million.
• LayerZero preliminarily attributed the attack to TraderTraitor, a unit within North Korea's Lazarus Group.
• Compromised RPC nodes, denial-of-service attacks and a single required verifier allowed a forged cross-chain message to be accepted.
• LayerZero blamed KelpDAO's configuration; KelpDAO said the default settings had been confirmed as appropriate during discussions about its expansion.
• Attackers used stolen rsETH as collateral on Aave v3 and created approximately $195 million in debt.
• Aave froze rsETH markets across five networks, registered a nearly $8 billion decline in deposited value and faced temporary restrictions affecting more than $5.1 billion in stablecoins.
• Total value locked across DeFi fell roughly $13 billion in the 48 hours after the theft.
• Arbitrum's Security Council froze approximately 30,766 ETH worth $71 million, about a quarter of the stolen value.
• The alleged Drift Protocol theft and KelpDAO attack brought the amount attributed to North Korean hackers in April to more than $575 million.
• LayerZero announced it would stop signing messages for applications using a single verifier.