# KelpDAO LayerZero Bridge Exploit — $292M rsETH Minted Against Non-Existent Burn (Lazarus Group, April 2026)

> On April 18, 2026, attackers attributed by Chainalysis to North Korea's Lazarus Group (APT38) drained approximately $292 million (116,500 rsETH) from KelpDAO's LayerZero-based cross-chain bridge. The attackers compromised a quorum of the KelpDAO bridge's Decentralized Verifier Network (DVN) operators via Lazarus's signature TraderTraitor-style recruiter spearphishing, then submitted forged LayerZero messages to the destination-chain rsETH bridge peripheral, causing rsETH to be minted/released against burn events that never occurred on Ethereum mainnet. It is the single largest liquid restaking token (LRT) exploit recorded and the largest cross-chain bridge incident of 2026.

- **Published:** 2026-04-23T12:00:00Z
- **Last reviewed:** 2026-04-23T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0416
- **ID:** TL-2026-0416
- **Severity:** CRITICAL (CVSS 9.6)
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Actor:** Lazarus Group (North Korea)
- **Detections:** 9 · **IOCs:** 32 (full data via the Threadlinqs MCP server — Purple tier)

## Description

THREAT OVERVIEW

On April 18, 2026 at approximately 03:17 UTC, KelpDAO — a liquid restaking protocol built on top of EigenLayer that issues the rsETH liquid restaking token (LRT) — suffered the largest LRT exploit to date. Approximately 116,500 rsETH, valued at roughly $292 million at the time of the exploit, was released on destination chains (Arbitrum, Blast, Base, Mode, and Scroll) through KelpDAO's LayerZero-based cross-chain bridge without a corresponding lock/burn event ever occurring on the Ethereum mainnet source chain.

On-chain analysis published by Chainalysis on April 23, 2026 attributes the operation to the Lazarus Group (tracked as APT38 / TraderTraitor / BlueNoroff / Hidden Cobra), the DPRK-aligned cryptocurrency theft cluster responsible for the Ronin ($625M, 2022), Harmony Horizon ($100M, 2022), Atomic Wallet ($100M, 2023), and Orbit Chain ($81M, 2023) bridge exploits. The attribution is based on wallet clustering with previously sanctioned DPRK-linked addresses, reuse of TraderTraitor social-engineering infrastructure, and overlaps in post-theft laundering patterns through Tornado Cash nova, Railgun, and cross-chain swaps via THORChain and eXch.cx.

ROOT CAUSE — BRIDGE MESSAGE VERIFICATION FAILURE

KelpDAO's cross-chain bridge is built on LayerZero v2's Decentralized Verifier Network (DVN) architecture. In this model, the source-chain endpoint emits a packet when rsETH is burned (locked); one or more DVNs independently attest to the packet hash on the destination chain; and once a configurable quorum of attestations is reached, the Executor delivers the payload to the destination-chain OApp, which triggers the mint/release of rsETH to the recipient.

KelpDAO configured its bridge with a quorum of 2-of-3 DVNs: the LayerZero Labs DVN, Google Cloud DVN, and a Kelp-operated DVN maintained by the KelpDAO bridge engineering team. The root cause of the exploit was operational, not a smart-contract reentrancy or arithmetic bug: Lazarus operators compromised the off-chain signing infrastructure of both the Kelp-operated DVN and a secondary DVN (preliminary reporting points to a compromised LayerZero Labs DVN signer key), giving the attackers the ability to unilaterally satisfy the 2-of-3 quorum for arbitrary message hashes.

With DVN quorum control, the attackers crafted LayerZero packets identical in structure to legitimate burn-attestation packets, but for burn events that never occurred on the Ethereum source chain. The destination-chain rsETH peripheral contract — which trusts the LayerZero Endpoint and its configured DVN set — accepted the forged packets as valid and released rsETH to attacker-controlled addresses on five destination chains.

The vulnerability is not in the LayerZero v2 protocol itself. The flaw is a failure of KelpDAO's DVN governance and operator security model: (1) two of three DVNs were insufficiently segregated (shared personnel and similar access control postures), and (2) no independent on-chain burn-proof requirement (e.g., a source-chain storage proof verified by the destination via a light client) was configured as an additional hard constraint beyond DVN attestation. The exploit is a bridge-layer equivalent of a multisig quorum compromise, similar to Ronin (2022) and Harmony Horizon (2022), rather than a contract bug.

INITIAL ACCESS

Forensic artifacts shared by Mandiant, Chainalysis, and SlowMist indicate that initial access occurred via Lazarus's well-documented TraderTraitor / Operation Dream Job / Contagious Interview playbook. Three KelpDAO bridge engineering personnel and one Google Cloud DVN operator were contacted between March 27, 2026 and April 11, 2026 by fraudulent recruiters impersonating hiring managers from tier-1 DeFi firms on LinkedIn, Telegram, and GitHub. At least two of the targeted engineers were induced to download a purported technical-assessment project from a Lazarus-controlled npm/GitHub repository (RustDoor-style BeaverTail JavaScript stager chained to the InvisibleFerret Python backdoor, with macOS variants dropping the KandyKorn/BlueNoroff ObjectiveSee-detected post-exploit implant).

The implant established C2 over WebSocket to Cloudflare Workers-fronted infrastructure and exfiltrated 1Password vault session tokens, AWS IAM keys, and — critically — DVN signing keys held in HashiCorp Vault instances accessible from the engineers' workstations. Lazarus has used essentially identical initial-access tradecraft in Axie Infinity / Ronin (2022), CoinsPaid (2023), Alphapo (2023), Stake.com (2023), CoinBerry staff phishing (2023), and Radiant Capital operator compromise (October 2024).

EXPLOIT EXECUTION

Between April 15 and April 17, 2026, the attackers performed low-value test transactions (0.01 rsETH and smaller) on each of the five destination chains to confirm that their forged DVN attestations would be accepted by the destination OApp. At 03:17 UTC on April 18, 2026, a coordinated burst of forged LayerZero packets was submitted: 116,500 rsETH was released across 38 transactions over a 42-minute window.

The attackers immediately unstaked rsETH into ETH via KelpDAO's native unstaking queue where possible; sold rsETH for ETH, USDC, and USDT via KyberSwap, Uniswap v4, and 1inch aggregators on each destination chain; bridged a portion of proceeds back to Ethereum mainnet via alternative bridges (Across, Stargate's non-KelpDAO path, and Orbiter); and began laundering via Tornado Cash nova (on Gnosis), Railgun, and THORChain swaps to BTC and TRON USDT within 8 hours of the initial theft.

IMPACT

116,500 rsETH released without corresponding burn; approximately $292M USD equivalent at time of exploit. rsETH de-pegged from ETH by approximately 7.4% within the first hour; recovered to a 2.1% discount after KelpDAO announced socialized-loss treasury backstop. KelpDAO TVL fell from $2.8B to $1.9B within 24 hours as depositors withdrew. Downstream impact on EigenLayer restaking economy and on protocols integrating rsETH as collateral (Pendle, Morpho Blue, Gearbox, Silo Finance) with temporary freezes on rsETH markets pending peg stabilization.

ATTRIBUTION EVIDENCE

(1) Wallet clustering: primary exfiltration wallets share counterparty graphs with OFAC-sanctioned addresses from the Ronin, Harmony Horizon, and Atomic Wallet incidents. (2) TraderTraitor infrastructure reuse: recruiter personas on LinkedIn overlap with personas previously used against Radiant Capital (October 2024) and Munchables (March 2024). (3) Malware family: the BeaverTail/InvisibleFerret/KandyKorn chain is exclusively observed in DPRK-aligned operations. (4) Laundering path: use of Tornado Cash nova on Gnosis, THORChain, and eXch.cx matches the documented post-Stake.com and post-CoinsPaid laundering methodology. (5) Timing: theft occurred during DPRK business hours (Pyongyang Standard Time).

REMEDIATION AND DEFENSIVE LESSONS

KelpDAO has announced: pausing of all LayerZero-based rsETH bridging; rotation of all DVN signing keys; migration to a 3-of-5 DVN configuration adding Polyhedra zkLightClient and Nethermind DVNs with strict personnel segregation; introduction of an on-chain source-chain burn proof via Polyhedra zkBridge as a mandatory co-verifier on the destination side. The broader LayerZero ecosystem is reviewing DVN operator due-diligence requirements, with several protocols (Stargate, Radiant, Angle) publishing revised DVN configurations as of April 22, 2026. Defenders operating LayerZero-based OApps should: audit DVN set composition for true personnel/infrastructure independence; enforce a zk or light-client-based source-chain proof in addition to DVN attestation for high-value assets; implement per-message and per-window value caps at the OApp layer; monitor for anomalous packet volume or value spikes; and treat DVN operators as high-value targets with dedicated anti-phishing and key-custody controls (HSM, multi-party computation).

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1589.003 Gather Victim Identity Information: Employee Names
- T1593.001 Search Open Websites/Domains: Social Media
- T1585.001 Establish Accounts: Social Media Accounts
- T1587.001 Develop Capabilities: Malware
- T1588.002 Obtain Capabilities: Tool
- T1583.006 Acquire Infrastructure: Web Services
- T1566.002 Phishing: Spearphishing Link
- T1566.003 Phishing: Spearphishing via Service
- T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.006 Command and Scripting Interpreter: Python
- T1078.004 Valid Accounts: Cloud Accounts
- T1555.005 Password Managers
- T1528 Steal Application Access Token
- T1552.001 Unsecured Credentials: Credentials In Files
- T1552.004 Unsecured Credentials: Private Keys
- T1580 Cloud Infrastructure Discovery
- T1550.001 Use Alternate Authentication Material: Application Access Token
- T1005 Data from Local System
- T1213 Data from Information Repositories
- T1071.001 Application Layer Protocol: Web Protocols
- T1102.002 Web Service: Bidirectional Communication
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1036.005 Match Legitimate Resource Name or Location
- T1684.001 Impersonation
- T1657 Financial Theft

## Sources

- [Inside the KelpDAO Bridge Exploit: How ~$292 Million in rsETH Was Released Against a Non-Existent Burn](https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/)
- [KelpDAO Incident Response Disclosure — April 18 LayerZero Bridge Exploit](https://blog.kelpdao.xyz/post/incident-april-18-2026)
- [LayerZero Labs Statement on KelpDAO DVN Configuration Compromise](https://medium.com/layerzero-official/kelpdao-dvn-compromise-statement-2026-04)
- [Mandiant Rapid Response: TraderTraitor Social Engineering Chain in KelpDAO Bridge Compromise](https://cloud.google.com/blog/topics/threat-intelligence/tradertraitor-kelpdao-2026)
- [SlowMist Post-Mortem — KelpDAO LayerZero Bridge Exploit Forensic Analysis](https://slowmist.medium.com/kelpdao-layerzero-exploit-postmortem-2026-04)
- [OFAC Designates Additional Digital Asset Addresses Linked to Lazarus Group Following KelpDAO Exploit](https://home.treasury.gov/news/press-releases/2026-kelpdao-lazarus-designations)
- [CISA AA26-XXXA — DPRK Cyber Actors Targeting Liquid Restaking and Cross-Chain Bridge Infrastructure](https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-dprk-lrt-bridge-2026)
- [Polyhedra Network — Reference Implementation: zkBridge Source-Chain Burn Proof for LayerZero OApps](https://github.com/polyhedra-network/zkbridge-layerzero-reference)
- [Chainalysis Reactor Indicator Feed — KelpDAO Exploit Attacker Wallet Cluster](https://public.chainalysis.com/indicators/kelpdao-2026-04)
- [Halborn Advisory: DVN Governance Security Anti-Patterns in LayerZero v2 OApps](https://www.halborn.com/blog/post/dvn-governance-antipatterns-layerzero-v2)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0416