# KelpDAO rsETH Bridge Exploit (April 2026)

## 1. What happened

On 2026-04-18 at 17:35 UTC an attacker forged a cross-chain message and drained **116,500 rsETH
(~$292M then)**, ~18% of the ~630,000-token supply, from KelpDAO's LayerZero-based rsETH bridge
(https://layerzero.network/publications/kelpdao-incident-report.pdf ; https://rekt.news/kelpdao-rekt ;
https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/).

Chains: released on **Ethereum mainnet** by the rsETH OFT Adapter (0x85d456b2...e98ef3); the forged
packet claimed to come from KelpDAO's rsETH OApp on **Unichain**, the only source chain whose peer
was registered on the adapter (https://www.migalabs.io/uploads/Kelp_DAO_IEEE_V4_6_BRAINS_2026_6361a2be9b.pdf ;
https://gist.github.com/banteg/705d0284513b74ad20f61d90f5b5de62).

Taken: custodied rsETH belonging to users who had bridged out. The adapter held 116,723.52 rsETH one
block before and 223.52 after (https://gist.github.com/banteg/705d0284513b74ad20f61d90f5b5de62) -- a
custody release, not a mint of new supply
(https://www.migalabs.io/uploads/Kelp_DAO_IEEE_V4_6_BRAINS_2026_6361a2be9b.pdf).

Amount sources disagree: ~$292M (LayerZero, Chainalysis, KelpDAO: incident-report.pdf, chainalysis link,
KelpDAO X below), ~$290M (BlockSec, rekt; rekt cites Cyvers at $293.7M:
https://rekt.news/kelpdao-rekt), ~$294M (migalabs PDF below).

KelpDAO paused contracts ~46 min after the drain, blocking a second packet (nonce 309, ~40,000 rsETH /
~$95-100M) (https://rekt.news/kelpdao-rekt ; banteg gist ; KelpDAO X).

## 2. Root cause

Not a smart-contract bug. Per LayerZero's post-mortem, a developer was socially engineered on
2026-03-06 (malicious GitHub repo, macOS malware); session keys let the attacker poison two internal
op-geth RPC nodes used by the LayerZero Labs DVN, returning a forged `PacketSent`/state response to
the DVN's IPs only while looking normal to monitoring. The attacker then DDoS'd external RPC providers
so failover relied solely on the poisoned nodes, yielding a valid attestation for a message that never
occurred on Unichain (https://layerzero.network/publications/kelpdao-incident-report.pdf). The app's
**1-of-1 DVN config** (one required DVN, no optional DVNs, zero threshold) made one attestation enough:
the destination library's hash-equality check passed and the adapter released funds
(https://rekt.news/kelpdao-rekt ;
https://blocksec.com/blog/the-decentralization-dilemma-cascading-risk-and-emergency-power-in-the-kelp-dao-crisis).
KelpDAO published no full post-mortem; its account is the "April 18 Incident: Additional Context"
thread, which says the 1-of-1 setup was LayerZero's documented default
(https://x.com/KelpDAO/status/2046332070277091807). Attribution: DPRK TraderTraitor/UNC4899
(https://layerzero.network/publications/kelpdao-incident-report.pdf ;
https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/).

## 3. Pattern

**Cross-chain message validation** failure from a **single-verifier trust assumption plus off-chain
(RPC) infrastructure compromise**. The destination checks only that the required DVN(s) signed the
payload hash; it never confirms the claimed source burn happened.

    verify(payloadHash, sigs):
        assert quorum(configured_DVNs, sigs)   # hash/signer equality only
        commit(payloadHash)                    # dest releases/locks
    # no assertion that the source PacketSent/burn exists

With `requiredDVNs = [one]`, forging one attestation is sufficient. The forgery is provable on-chain:
Unichain's outbound nonce stayed 307 (308 never existed) and Unichain's rsETH supply was only 49.26,
so 116,500 could not have been burned (https://rekt.news/kelpdao-rekt ; banteg gist).

## 4. The check that would have caught it

1. **Cross-chain invariant monitoring (catches it live).** Continuously assert the destination release
   is backed by a matching source burn: `released_on_dest <= burned_on_src` and
   `dest_inbound_nonce <= src_outbound_nonce` per channel. Chainalysis names this exact missing
   detection (https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/). banteg's
   reproducible `eth_getLogs` scan of Unichain's EndpointV2 for the claimed `PacketSent` returns 0
   events -- a concrete proof-of-non-existence test
   (https://gist.github.com/banteg/705d0284513b74ad20f61d90f5b5de62).
2. **Deployment-gating config test / review rule.** Assert the invariant
   `requiredDVNCount + optionalDVNCount >= 2` with independently operated DVNs and fail CI/deploy
   otherwise; a 2-of-2 stack would have required compromising two independent DVNs at once
   (https://layerzero.network/publications/kelpdao-incident-report.pdf ;
   https://www.quillaudits.com/blog/hack-analysis/kelp-dao-hack). Operational control: refuse to sign
   as the sole required attestor on any channel
   (https://layerzero.network/publications/kelpdao-incident-report.pdf).

## 5. Sources

https://layerzero.network/publications/kelpdao-incident-report.pdf
https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report
https://x.com/KelpDAO/status/2046332070277091807
https://rekt.news/kelpdao-rekt
https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/
https://blocksec.com/blog/the-decentralization-dilemma-cascading-risk-and-emergency-power-in-the-kelp-dao-crisis
https://www.quillaudits.com/blog/hack-analysis/kelp-dao-hack
https://discover.credshields.com/incident-report-kelp-dao-rseth-bridge-exploit/
https://www.migalabs.io/uploads/Kelp_DAO_IEEE_V4_6_BRAINS_2026_6361a2be9b.pdf
https://gist.github.com/banteg/705d0284513b74ad20f61d90f5b5de62
https://ethdaily.io/layerzero-publishes-full-post-mortem-on-dollar292m-kelpdao-exploit
https://www.kucoin.com/blog/kelpdao-hack-2026-rseth-exploit-analysis
https://shattered.io/kelp-dao-sues-layerzero-292-million-rseth-2026/

Not found: a standalone SlowMist or CertiK technical post-mortem; CertiK/Cyvers figures appear
second-hand via rekt. KelpDAO published no full root-cause post-mortem.