KelpDAO / LayerZero · 2026-04
The April 18, 2026 KelpDAO exploit — resulting in approximately $290M in losses — was a sophisticated supply-chain-style RPC poisoning attack attributed to DPRK's TraderTraitor cluster, in which the threat actor compromised two independent RPC nodes used by LayerZero Labs' DVN, replaced their op-geth binaries with malicious versions that selectively forged transaction confirmations only to the DVN while reporting truthfully to all other observers, and simultaneously DDoS'd uncompromised RPC nodes to force failover onto the poisoned infrastructure — an attack that succeeded exclusively because KelpDAO's rsETH was configured with a single 1-of-1 DVN, eliminating any redundant verification that would have otherwise blocked the forged message.
CSIS entry 8 · April 2026
A hacker group suspected to be linked to the DPRK successfully exploited a major crypto-currency exchange platform with costs estimated at roughly $293 million dollars according to LayerZero Labs which provides the infrastructure for the KelpDAO’s RsETH configuration. LayerZero claims that this attack is isolated; however, the incident alone represents the largest decentralized finance (DeFi) attack of 2026.
KelpDao - Rekt · 4/18/2026
Excerpt: DPRK breached LayerZero's infrastructure, forged a bridge message, and walked $290 million out of KelpDAO in one transaction. Aave is holding hundreds of millions in bad debt. The dominoes are still falling. DeFi United is scrambling to catch them. | Article date: 4/24/2026
KelpDAO LayerZero bridge exploit (off-chain infrastructure attack) · published 2026-04-23 (April 18, 2026)
On April 18, 2026, attackers linked to North Korea's Lazarus Group stole ~$292 million (116,500 rsETH) from KelpDAO's LayerZero bridge.
KelpDAO bridge exploit · published 2026-04-30 (April 18, 2026)
The Drift Protocol breach on April 1 (USD 285 million) and the KelpDAO bridge exploit on April 18 (USD 292 million) represent 3% of 2026 incident count and 76% of stolen value.
KelpDAO/LZ exploit laundering via Thorchain and Umbra · 2026-04-21 (post date)
Update: DPRK began laundering $1.5M from the $290M KelpDAO/LZ exploit from Ethereum mainnet to Bitcoin via Thorchain
Kelp DAO hack · published 2026-04-20
The Kelp DAO attack has been attributed to North Korea's Lazarus Group.
Kelp DAO hack (forged LayerZero message) · (page date not captured; April 2026)
The suspected Lazarus Group hackers behind the $292 million Kelp DAO hack are on the move, transferring 76K ETH (worth $175M) on-chain to new addresses.
La Corée du Nord aurait volé 290 millions de dollars en crypto · 2026-04-22
attribution sentence(s): Une cyberattaque attribuée au groupe nord-coréen «Lazarus» a visé le coffre-fort de KelpDAO, une plateforme de finance décentralisée spécialisée dans le restaking. | «Les premiers indices laissent à penser que cette attaque est le fait d’un acteur étatique hautement sophistiqué, probablement le groupe nord-coréen Lazarus», a ajouté l’application. | Pour lui, «c’est clairement l’œuvre du groupe Lazarus de Corée du Nord».
Hackers norcoreanos sospechosos de robo de criptomonedas por $300 millones · 2026-04-22
attribution sentence(s): Un panel de la ONU estimó en 2024 que Corea del Norte había robado más de $3.000 millones en criptomonedas desde 2017 | Se trata del último incidente de este tipo vinculado a Corea del Norte, cuyo sofisticado programa de ciberdelincuencia utiliza las criptomonedas robadas para financiar el desarrollo de sus armas nucleares, según un panel de Naciones Unidas. | “Los indicadores preliminares sugieren que el responsable es un actor estatal altamente sofisticado, probablemente el Grupo Lazarus de la RPDC”, afirmó LayerZero, utilizando las iniciales del nombre oficial de Corea del Norte.
Kuzey Koreli hackerlar iş başında: 300 milyon dolarlık kriptoyu çaldılar · 2026-04-22
attribution sentence(s): Kuzey Koreli bir grup bilgisayar korsanının büyük bir soygun gerçekleştirdiği ortaya çıktı. | LayerZero tarafından yapılan resmi açıklamada, ön araştırmalarda soygunun arkasında Kuzey Kore’li "Lazarus Group" adlı hacker grubunun olduğu ifade edildi. | 2009 yılında kurulduğu belirtilen Lazarus Group, Kuzey Kore devleti tarafından desteklendiği iddia edilen bir hacker grubu.
Der bislang größte Krypto-Raub des Jahres: Nordkoreanische Hacker sollen Kryptowährungen in Millionenhöhe gestohlen haben · 2026-04-22
attribution sentence(s): Nordkoreanische Hacker sollen Kryptowährungen in Millionenhöhe gestohlen haben | Eine Hackergruppe aus Nordkorea hat mutmaßlich eine hohe Summe an digitalen Währungen erbeutet. | Nordkoreanische Hacker haben nach Angaben von Krypto-Plattformen mutmaßlich digitale Währungen in dreistelliger Millionenhöhe erbeutet.