KelpDAO Loses $292M in 2026 DeFi Bridge Hack

In April 2026, liquid restaking protocol KelpDAO suffered the largest decentralized finance (DeFi) exploit of the year, losing approximately $292 million in a sophisticated attack on its cross-chain bridge [1]. The incident, attributed by LayerZero to the North Korean-linked TraderTraitor subgroup, involved compromising remote procedure call (RPC) nodes to trick a single verifier into releasing 116,500 rsETH tokens [1][2]. This theft triggered a broader liquidity crisis, resulting in billions of dollars in withdrawals across the DeFi ecosystem [1].

Key takeaways

• KelpDAO lost $292 million after an attacker exploited a single-verifier configuration on its LayerZero bridge [1].
• The attacker used compromised RPC nodes and a DDoS attack to forge data and bypass security checks [1].
• Depositing stolen rsETH as collateral on Aave allowed the attacker to borrow roughly $236 million in other assets [2].
• The exploit caused a bank run, with over $13 billion withdrawn from DeFi protocols within 48 hours [1].

Bridge Configuration and Node Manipulation

KelpDAO utilized a bridge built on LayerZero’s messaging infrastructure to move its rsETH token between networks, a setup that relied on a single verifier to confirm cross-chain transfer instructions [1]. On April 18, attackers compromised two RPC nodes—the servers that relay blockchain data to the verifier—and fed them forged data while accurately reporting to other monitoring systems [1]. A simultaneous distributed denial-of-service (DDoS) attack forced the verifier to fail over to the poisoned nodes, leading the system to approve a fraudulent instruction that released 116,500 rsETH to an attacker-controlled address [1]. Following the breach, a dispute arose regarding liability, with LayerZero blaming KelpDAO’s single-verifier configuration, while KelpDAO countered that this was the default setup used by roughly 40% of protocols on the network [1].

Cascading Losses and Market Panic

After obtaining