Key Takeaways
- On April 18, attackers drained 116,500 rsETH tokens valued at $292 million from Kelp DAO’s LayerZero-based bridge
- Stolen tokens were deposited into Aave V3 as collateral to extract wrapped Ether
- Aave faces potential bad debt ranging from $123.7 million to $230.1 million depending on recovery decisions
- Security configuration disputes have emerged between Kelp DAO and LayerZero over DVN settings
- Aave maintains $181 million in treasury reserves to address potential shortfalls
The DeFi sector witnessed its most significant breach of 2026 when Kelp DAO experienced a devastating attack on April 18. Hackers successfully extracted 116,500 rsETH tokens through vulnerabilities in its LayerZero cross-chain bridge infrastructure, resulting in losses totaling approximately $292 million.
According to LayerZero’s investigation, the perpetrators—suspected to be North Korea’s Lazarus Group—compromised RPC nodes operating within the decentralized verified network. The attack methodology involved poisoning two nodes while simultaneously launching a DDoS assault on a third, effectively manipulating the system into validating fraudulent cross-chain messages that authorized the minting of 116,500 rsETH tokens.
Kelp DAO’s response team acted swiftly upon discovering the security breach. The protocol immediately froze all affected smart contracts and implemented wallet blacklisting measures targeting addresses associated with the attacker. These emergency actions successfully prevented an additional theft of 40,000 rsETH tokens, valued at approximately $95 million.
The compromised tokens subsequently appeared on Aave V3, where the attacker deployed a sophisticated strategy. By supplying 89,567 rsETH (valued around $221 million) as collateral, they extracted 82,650 wrapped Ether along with 821 wstETH. These borrowing positions now operate at critically low health factors, creating substantial bad debt exposure for Aave.
Since the exploit occurred, Aave has experienced nearly $10 billion in outflows.
Accountability Debate Intensifies
LayerZero released an analysis highlighting concerns about Kelp DAO’s 1-of-1 DVN configuration, characterizing it as establishing a single point of failure vulnerability. The report indicated that Kelp had received recommendations to implement a more diversified DVN architecture but declined to do so.
Kelp DAO contested this characterization, pointing out that the 1-of-1 configuration represents the standard setup outlined in LayerZero’s official documentation. According to Kelp, LayerZero explicitly validated this configuration as suitable when the protocol expanded operations to layer 2 networks.
Both organizations have stated their commitment to collaborative resolution efforts.
Aave’s Financial Exposure Analysis
LlamaRisk, serving as Aave’s risk management provider, has developed two distinct scenarios projecting how bad debt could materialize based on Kelp DAO’s forthcoming decisions.
The first scenario distributes losses uniformly across all rsETH holders on Ethereum mainnet and layer 2 networks. This approach would trigger a 15% depeg of rsETH and generate approximately $123.7 million in bad debt for Aave. Ethereum’s primary market would shoulder the largest nominal loss at $91.8 million, though its substantial reserves would limit the shortfall to 1.54%.
Mantle would experience the most severe proportional impact at 9.54% in this scenario.
The alternative scenario confines all losses exclusively to layer 2 networks while maintaining full backing for Ethereum mainnet rsETH. This pathway would impose a 73.54% haircut on layer 2 collateral and escalate total bad debt to $230.1 million across markets on Mantle, Arbitrum, and Base.
The first scenario would activate Aave’s Umbrella security module, which holds $54 million available as a protective buffer. This mechanism would remain inactive under the second scenario.
Aave emphasized that final outcomes hinge on how Kelp DAO adjusts its rsETH accounting methodology and oracle exchange rate mechanisms. The Aave DAO currently maintains $181 million in treasury assets and has secured commitments from ecosystem stakeholders to provide support should bad debt crystallize.
As of Monday, Kelp DAO continues evaluating the financial ramifications and has yet to announce a definitive loss allocation framework or recovery strategy.
