Kelp DAO Exploit Fallout Deepens as Attacker Routes $175M in ETH via Privacy Rails
Key Takeaways:
- The attacker moved $175 million in stolen ETH to new wallets using privacy tools.
- The exploit involved siphoning 116,500 rsETH via Kelp DAO’s LayerZero bridge.
- LayerZero criticized for their single verifier network setup that was exploited.
- Aave faces a potential $123.7 million to $230.1 million loss from the breach.
- LayerZero suggests possible involvement of the Lazarus Group in the attack.
WEEX Crypto News, 2026-04-22 12:16:02
Kelp DAO’s Security Breach Unfolds
The Kelp DAO breach, which resulted in roughly $290 million being compromised, has taken a new turn as the perpetrator maneuvers $175 million in Ether across new wallet addresses. The activity shows early signs of efforts to obscure the Ether’s origins following the heist. Blockchain data from Arkham revealed transactions moving 75,700 Ether via three transfers, one notably moving 25,000 ETH to a newly generated wallet.
[Place Image: Transaction flow of ETH transfers]
Privacy Rails Employed in Fund Movement
ZachXBT, a prominent on-chain investigator, identified the use of privacy-centric networks like THORChain and Umbra in masking the stolen Ether. Specifically, THORChain transactions totaled about $1.5 million, while Umbra was used for a $78,000 transfer. These tools complicate tracing efforts by avoiding conventional Know Your Customer (KYC) checks and disperse funds across multiple protocols.
Exploit Linked to LayerZero’s Bridge Vulnerability
The security breach, targeting approximately 116,500 rsETH from Kelp DAO’s bridge on LayerZero, underscores issues with utilizing a 1-of-1 decentralized verifier network. LayerZero criticized Kelp DAO for this setup, highlighting a “single point of failure” risk, which they state they cautioned against previously. LayerZero’s recommended solution was a multi-verifier approach for handling significant valuations, which Kelp DAO did not adopt.
Impact on Decentralized Finance (DeFi) Ecosystem
Following the exploit, Arbitrum’s security council froze 30,766 ETH associated with the theft in a provisional locked wallet pending governance approval. The breach’s consequences extended to Aave, with the attacker using the pilfered assets as collateral. Initial assessments indicated a $195 million deficit, while Aave’s detailed incident report predicts a potential debt range from $123.7 million to $230.1 million.
Blame and Theories Over the Breach’s Origin
While LayerZero pointed to Kelp DAO’s infrastructure choices as the root cause, suggesting possible North Korean Lazarus Group involvement, Kelp DAO defended their approach. They claim the single-validator system was part of LayerZero’s foundational framework. Security analysts confirmed the bridge’s reliance on a simple DVN that allowed unauthorized command validation, facilitating the rsETH’s unlawful transfer.
[Place Image: Graphical depiction of the LayerZero bridge security flaw]
FAQ Section
What networks were used to move the stolen ETH?
The attacker utilized privacy-focused networks like THORChain and Umbra to obscure the transfers of the stolen ETH.
Why was the LayerZero’s verifier setup criticized?
LayerZero’s 1-of-1 verifier network was seen as a vulnerability, creating a single point of failure that was exploited in the breach.
How did the breach affect the DeFi platform Aave?
The stolen assets were used as collateral on Aave, potentially resulting in a financial shortfall of up to $230.1 million.
What measures are being taken to recover the stolen funds?
Arbitrum froze 30,766 ETH linked to the attack in a locked wallet controlled by governance decisions to prevent further unauthorized access.
Could the Lazarus Group be involved in this exploit?
LayerZero suggested the possibility of the Lazarus Group’s involvement; however, this remains speculative and has not been confirmed.
Overall, the Kelp DAO incident highlights pressing vulnerabilities and trust challenges in cross-chain bridges and the broader DeFi space.
-- Price
This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.
You may also like

LayerZero Unveils ATLAS Exchange Engine

USDG0 Expands Multi-Chain Distribution Based on LayerZero

BitGo Changes $7.3 Billion WBTC Cross-Chain Service Provider to Chainlink CCIP

Circle's Public Blockchain Arc Appears to Be Live, Not Publicly Tested

Aave faced a withdrawal surge of $8.45 billion during the rsETH crisis, reigniting debates about the risk management capabilities of DeFi

FTX/Alameda Wallet Transfers Over $8 Million in ZRO Tokens to Wintermute
Key Takeaways An FTX/Alameda-associated wallet moved 4.126 million ZRO tokens to market maker Wintermute, with an approximate value…

North Korea’s $500M DeFi Heist Unveils New Cyber Warfare Tactics
Key Takeaways: North Korean operatives have obtained over $500 million from DeFi platforms in under three weeks. The…

DeFi Losses Top $600 Million Amid Kelp DAO Exploit and TVL Decline
Key Takeaways: Total DeFi losses have skyrocketed to approximately $1 billion recently, with $600M+ linked directly to the…

LayerZero releases KelpDAO security incident report: will adjust security policies and rebuild affected cloud infrastructure

Why is a16z Crypto raising another $2.2 billion to heavily invest in Web3?

LayerZero CEO counters KelpDAO: rsETH initially used the default configuration, then manually switched to the not recommended 1/1 configuration

Kelp DAO abandoned LayerZero after the attack incident and switched to Chainlink's cross-chain infrastructure

Analyst: The attacker of the Wasabi protocol has transferred all stolen funds to Tornado Cash

The billion-dollar lesson: The focus of DeFi security is shifting from code to operational governance

Blockchain trading platform Ekiden has completed a $2 million seed round financing, with participation from Unicorn Factory Ventures and others

Morning Report | Visa includes Polygon in its global stablecoin settlement program; MoonPay invests $100 million to acquire security company Sodot; Digital wallet platform Belo completes $14 million Series A financing

KelpDAO injects 2000 ETH into the DeFi United Recovery Fund to advance the rsETH recovery plan

Encrypted data and research platform Blockworks completes Series A extension financing with a valuation of $192 million, led jointly by Parafi Capital and Reciprocal Ventures

DeFi United announced the technical solution for the Kelp rsETH vulnerability, planning to liquidate approximately 107,000 tokens from the attacker’s position

LayerZero promises to provide DeFi United with over 10,000 ETH, including a donation of 5,000 ETH

DeFi United raised over 300 million dollars

DeFi United rescue latest progress: over 100,000 ETH raised

How to balance risk and return in DeFi yields?

Aave announces the establishment of a recovery fund to promote full asset-backed recovery of rsETH

The DeFi United ecological rescue operation has raised over 69,618 ETH, worth approximately 161 million USD

Aave leads DeFi "patching" stop-loss, due to KelpDAO being hacked for $292 million in a chain reaction

Lido proposes to use up to $5.8 million in stETH to fill the funding gap for Kelp

North Korea’s $500M DeFi Heist Unveils New Cyber Warfare Tactics
Key Takeaways: North Korean operatives have obtained over $500 million from DeFi platforms in under three weeks. The…

The attacker of KelpDAO transferred part of the stolen funds across chains to Arbitrum, exchanged them for USDT, and flowed into the Tron ecosystem

Ethena has restored the LayerZero cross-chain bridge functionality for sUSDe and USDe and strengthened security configurations
LayerZero Unveils ATLAS Exchange Engine
USDG0 Expands Multi-Chain Distribution Based on LayerZero
BitGo Changes $7.3 Billion WBTC Cross-Chain Service Provider to Chainlink CCIP
Circle's Public Blockchain Arc Appears to Be Live, Not Publicly Tested
Aave faced a withdrawal surge of $8.45 billion during the rsETH crisis, reigniting debates about the risk management capabilities of DeFi
FTX/Alameda Wallet Transfers Over $8 Million in ZRO Tokens to Wintermute
Key Takeaways An FTX/Alameda-associated wallet moved 4.126 million ZRO tokens to market maker Wintermute, with an approximate value…











