The $292M KelpDAO Bridge Exploit

What happened

KelpDAO is a liquid restaking protocol on EigenLayer. Users deposit ETH or LSTs and receive rsETH as a tradeable receipt. To make rsETH usable across the EVM ecosystem, KelpDAO contracted with LayerZero to bridge the token to 20+ networks — Arbitrum, Base, Optimism, Polygon, BNB Chain, Linea, Scroll, and others.

For each cross-chain transfer, LayerZero relies on Decentralised Verifier Networks (DVNs) to attest that an event happened on the source chain. Kelp's bridge configuration used a single DVN, run by a single operator, with no second independent verifier and no committee threshold. Attackers identified that this single verifier was the entire trust assumption for hundreds of millions of dollars of bridged rsETH.

On April 18, 2026, beginning at roughly 17:35 UTC, attackers fed the verifier forged messages claiming that rsETH had been burned on a source chain. The verifier, with its data feeds compromised, signed off. LayerZero's mint contract on Ethereum honoured the message and minted 116,500 rsETH to attacker-controlled addresses. None of those tokens were backed by any actual rsETH lock-up.

Hour-by-hour timeline

Root cause

This was not a smart contract bug. The Solidity code on both sides of the bridge worked as designed. The failure was at the verification layer.

LayerZero's security model lets each application choose its DVN configuration: which verifiers must sign, how many of how many, and which executor delivers the message. Configurations range from "1-of-1" (a single party can sign anything into existence) to "N-of-M" with diverse independent verifiers, optional pre-crime checks, and configurable timelocks.

KelpDAO's configuration was a 1-of-1 DVN. Once that single party's data feeds were compromised, the system had no second opinion. The attack worked by:

1. Compromising the verifier's internal RPC nodes via targeted intrusion. These are the nodes the verifier used to read the source chain.
2. Simultaneously DDoS-ing the verifier's external/public RPC fallbacks, forcing the client to keep relying on the compromised internal feeds.
3. Submitting cross-chain messages claiming rsETH had been burned on a sending chain when no such burn had actually occurred. The verifier read the false on-chain state from its own poisoned nodes and signed.
4. The destination chain's mint contract, seeing a valid signature, minted the receiving rsETH.

The blame fight

Within 48 hours, the post-mortem turned into a public dispute. The two narratives:

LayerZero's position

LayerZero argues that DVN configuration is the application's responsibility — the protocol is intentionally pluggable, including with multi-party setups, threshold committees and pre-crime checks. Kelp could have chosen a 3-of-5 DVN or required Polyhedra/Google Cloud as a second verifier; it didn't.

KelpDAO's position

Kelp argues that the 1-of-1 setup was the default during integration, that LayerZero engineers approved the configuration in writing, and that the platform's marketing materials emphasised the DVN's hardening rather than recommending a multi-verifier design. Kelp also points out that several other LayerZero integrations used identical configurations.

DeFi contagion

The attack was sophisticated less for its technical novelty than for how the attacker used the unbacked rsETH. Rather than dumping it directly (which would have crashed the price before they could exit), they used it as collateral to borrow other assets.

The bigger story is that everyone with rsETH exposure had to pause within hours. That's the cost of a fungible token being widely composable: when its supply is corrupted, every protocol that integrated it inherits the problem at the same moment.

Recovery efforts

As of April 27, recovery is still in flight. Key initiatives:

• DeFi United Recovery Fund — cross-protocol pool of ETH committed by Lido DAO, ether.fi, Golem and private contributors. ~69,500 ETH (~$161M) accumulated.
• Aave 25,000 ETH allocation — Aave governance approved using treasury reserves to backstop rsETH borrowers.
• KelpDAO recapitalisation plan — treasury, future fee revenue and a possible governance-token issuance to socialise the loss across rsETH holders rather than concentrating it on Aave.
• On-chain interdiction — Chainalysis and TRM tracking laundering through THORChain; some funds frozen at CEX off-ramps.

Open questions: how much of the $292M is recoverable, who absorbs the rest, and whether rsETH holders accept a permanent ~10–15% socialised loss in exchange for retaining redemptions.

Lessons for stakers and builders

1. Bridges are the weakest link in the LRT stack. The rsETH protocol itself wasn't compromised. The mint authority was — on a downstream chain, via a cross-chain message.
2. "Audited" doesn't cover configuration. Both Kelp and LayerZero contracts were audited. The vulnerable surface was the chosen verifier set and the operator's RPC infrastructure — areas no contract audit covers.
3. 1-of-1 verifier setups should be treated as 1-of-1 multisigs. If you wouldn't put $290M behind a single private key, don't put it behind a single verifier.
4. Composability accelerates contagion. The same property that makes LRTs useful (deep DeFi integration) is what made the attack so destructive so quickly.
5. Lending markets need bridge-aware risk parameters. Aave's risk team had no visibility into KelpDAO's bridge config. Lenders that accept bridged collateral need to track the verifier surface separately.
6. Recovery via socialisation is now standard. When a DeFi loss is too large to absorb anywhere, the answer keeps being "spread it across stakeholders". Restaking depositors should price that probability into expected returns.

Continue: Why bridges are crypto's most-attacked surface →