Key Takeaways
- A sophisticated attack drained 116,500 rsETH tokens valued at $292 million from Kelp DAO’s LayerZero-based bridge on April 18
- The stolen assets were leveraged as collateral on Aave V3 to extract wrapped Ether
- Aave faces potential bad debt exposure ranging from $123.7 million to $230.1 million depending on recovery approach
- Finger-pointing between Kelp DAO and LayerZero centers on disputed 1-of-1 DVN security architecture
- Aave maintains $181 million in treasury reserves as potential protection against losses
In what stands as 2026’s most significant DeFi security breach to date, Kelp DAO experienced a catastrophic exploit on April 18 that resulted in the theft of 116,500 rsETH tokens, representing approximately $292 million in value, through its LayerZero-integrated cross-chain infrastructure.
According to LayerZero’s analysis, the perpetrator—suspected to be the notorious Lazarus Group operating under North Korea’s direction—successfully compromised a roster of RPC nodes operating within its decentralized verification network. The attackers poisoned two nodes while simultaneously launching a distributed denial-of-service assault on a third, effectively manipulating the system into validating a fraudulent cross-chain transaction that authorized the creation of 116,500 rsETH tokens.
Upon detecting the security breach, Kelp DAO implemented immediate emergency measures. The protocol suspended all affected smart contracts and flagged addresses associated with the attacker, successfully preventing the loss of an additional 40,000 rsETH valued at approximately $95 million.
The compromised tokens were subsequently transferred to Aave V3. The attacker deposited 89,567 rsETH worth approximately $221 million as collateral to borrow 82,650 wrapped Ether plus 821 wstETH, creating positions with critically low health factors that expose Aave to substantial bad debt risk.
The protocol has experienced capital outflows approaching $10 billion since the exploit occurred.
Disputed Accountability
LayerZero released a technical analysis pointing to Kelp DAO’s 1-of-1 DVN architecture as the root cause, arguing it established an unacceptable single point of vulnerability. The company claims Kelp had received recommendations to implement a more diversified DVN structure but declined to act.
Kelp DAO countered these assertions, emphasizing that the 1-of-1 configuration represents the standard deployment pattern explicitly outlined in LayerZero’s official technical documentation. The protocol maintains that LayerZero personnel explicitly validated this configuration as suitable when Kelp expanded operations to include layer 2 blockchain networks.
Both organizations have committed to collaborative efforts toward resolution.
Aave’s Potential Loss Scenarios
LlamaRisk, serving as Aave’s risk management consultant, has constructed two distinct scenarios projecting how bad debt exposure might materialize based on Kelp DAO’s strategic decisions.
The first approach distributes losses proportionally across all rsETH token holders on Ethereum mainnet and layer 2 ecosystems. This methodology would trigger a 15% depegging of rsETH and generate approximately $123.7 million in bad debt for Aave. Ethereum’s primary market would absorb the largest nominal loss at $91.8 million, though its substantial reserves would limit the deficit to 1.54%.
Mantle network would experience the most severe proportional impact at 9.54% under this distribution model.
The alternative scenario concentrates all losses exclusively within layer 2 networks, preserving full backing for Ethereum mainnet rsETH. This approach inflicts a 73.54% reduction on layer 2 collateral values and elevates total bad debt to $230.1 million distributed across Mantle, Arbitrum, and Base markets.
The first scenario allows Aave’s Umbrella security module, holding $54 million, to function as a protective buffer. This protection mechanism would not be applicable under the second scenario.
Aave emphasized that the ultimate outcome hinges on Kelp DAO’s approach to updating rsETH accounting mechanisms and oracle exchange rate calculations. The Aave DAO commands $181 million in treasury resources and has secured pledges from ecosystem stakeholders to provide support should bad debt crystallize.
As of Monday, Kelp DAO indicated it continues evaluating the financial ramifications and has yet to publish a loss distribution framework or recovery roadmap.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
