Lazarus Group Drains $292M from KelpDAO Bridge

On April 18, 2026, attackers linked to North Korea's Lazarus Group exploited a vulnerability in KelpDAO's LayerZero-powered bridge, draining 116,500 rsETH valued at approximately $292 million. The incident, one of the largest cross-chain security breaches in decentralized finance this year, prompted KelpDAO to suspend its contracts, block additional forged transactions worth over $100 million, and migrate to Chainlink's Cross-Chain Interoperability Protocol.

The exploit targeted LayerZero's off-chain infrastructure. According to analyses from Chainalysis and independent security researchers, attackers compromised two RPC nodes used by LayerZero Labs' Decentralized Verifier Network, or DVN, and launched a distributed denial-of-service attack on remaining nodes. This forced the DVN to validate a nonexistent token burn transaction in KelpDAO's 1-of-1 DVN configuration, releasing unbacked rsETH. The stolen funds were deposited as collateral on platforms including Aave, where borrowers withdrew about $236 million in wrapped ETH and staked ETH equivalents, intensifying liquidity stress and leading to market freezes.

LayerZero described the breach as isolated to KelpDAO's rsETH...