Kelp DAO Hack: The rsETH Exploit and What It Means for LRTs

By the Guardian team Updated November 2026 6 min read

Quick answer. On April 18, 2026, poisoned RPC nodes fooled the sole DVN on a Kelp route, releasing 116,500 rsETH. The attacker borrowed against it on Aave, where rsETH's backing gap threatened an estimated $124M to $230M in bad debt.

Watch: Kelp DAO Hack: The rsETH Exploit and What It Means for LRTs 1:44

Video transcript

In April 2026, one forged LayerZero message drained Kelp DAO's rsETH bridge. Most of the stolen tokens ended up as Aave collateral.

It released 116,500 rsETH, which LayerZero valued at about 292 million dollars.

A LayerZero Labs developer cloned a malicious repo. The attacker poisoned two RPC nodes, forced failover with a denial of service, and the DVN attested to a burn that never happened.

No smart contract was broken. The route trusted one required DVN with no optional verifiers, so fooling it was enough.

The release almost emptied the lockbox backing bridged rsETH. On Aave, the attacker borrowed over 82,000 WETH on loans barely above liquidation.

LlamaRisk modeled bad debt of about 124 to 230 million dollars, stressing these were not predictions. Liquidations have since recovered most of the stolen rsETH.

Kelp was not alone. Nexus Mutual cited Dune data putting 47 percent of LayerZero apps on a one of one setup.

LayerZero and Kelp disagree on why the route had one DVN. Either way, check every route, require two independent DVNs, pin each setting and alert on changes. Lenders should size caps to the weakest route.

Since February 2025, Guardian has verified USDT zero's peers and DVN sets for every pathway, across more than 25 chains.

Read the full breakdown, or talk to Guardian before your next route carries value.

On April 18, 2026, an attacker took 116,500 rsETH from Kelp DAO's LayerZero bridge. LayerZero valued it at about $292 million at the time.

No smart contract was broken. One verifier was fed false chain data, and the route trusted that verifier alone.

Before Aave could freeze the market, most of the stolen rsETH was posted there as collateral. A bridge loss had become a lending market's problem.

What Happened on April 18

LayerZero's May 18 incident report traces the attack back six weeks:

March 6. A LayerZero Labs developer who maintained RPC nodes cloned a malicious GitHub repo. The malware gave the attacker session keys.
March 30 to April 16. The attacker used those keys to explore LayerZero's cloud and GitHub environments.
April 16 to 18. The attacker poisoned the op-geth process on two internal RPC nodes, in memory.

Then, on the day:

April 18 (UTC)	Event
16:30	A denial of service on external RPCs forces failover to the poisoned nodes
17:35	A forged packet releases 116,500 rsETH on Ethereum
46 minutes later	Kelp's emergency multisig pauses core contracts
18:52	Aave's Protocol Guardian starts freezing rsETH and wrsETH markets

Times come from LayerZero's report, Nexus Mutual's incident review and Aave's governance forum.

A second forged packet, for 40,000 rsETH, reverted because Kelp had frozen the recipient, according to LlamaRisk's report on the Aave forum.

Kelp's statement the next day said mainnet rsETH was unaffected, because "the primary impact occurred on the bridging infra."

One DVN, One Point of Failure

In LayerZero, every route has a security stack: required DVNs, optional DVNs and a threshold. Every required DVN must attest before a message is accepted.

LlamaRisk's report says Kelp's Unichain to Ethereum route "was configured as a 1-of-1 DVN path with no optional verifiers." That one DVN was LayerZero Labs' own.

So the attacker only had to fool one verifier. LayerZero's report shows how:

The poisoned nodes sent forged data to the DVN and correct data to LayerZero's monitoring.
The denial of service left the DVN reading only from those nodes.
The DVN attested to a Unichain message that never happened.
Ethereum accepted the single valid attestation, and the adapter released the tokens.

The packet claimed a burn of 116,500 rsETH on Unichain. LlamaRisk notes that Unichain's outbound nonce stayed at 307 while Ethereum accepted nonce 308.

LayerZero says the DVN's signing keys were not compromised, and that "there was no protocol-level failure." The protocol enforced the policy the route was given.

LayerZero's report adds that a second, independent required DVN would have forced the attacker to compromise both at once.

How the Loss Reached Aave

Bridged rsETH on other chains is backed by rsETH locked in an adapter on Ethereum. The forged message drained almost all of that lockbox.

LlamaRisk counts the adapter falling from 116,723 rsETH to 223, against 152,577 rsETH of claims on other chains.

The stolen tokens were real mainnet rsETH, and the attacker posted them as collateral:

Aave: 89,567 rsETH supplied; 82,650 WETH and 821 wstETH borrowed, per LlamaRisk.
Compound V3 and Euler: smaller positions, before those markets froze, per Rekt.

The Aave loans sat at health factors of about 1.01 to 1.03. Even a small fall in rsETH's value would make them liquidatable.

LlamaRisk modeled where the backing gap could land, stressing that these were not predictions:

If the loss is	Estimated bad debt	Where it lands
Shared by all rsETH	$123.7M	Mostly Ethereum Core WETH ($91.8M)
Isolated to L2 rsETH	$230.1M	WETH on Mantle, Arbitrum, Base and Ink

LlamaRisk adds that Aave's contracts were never compromised. Nexus Mutual put the problem plainly: "impaired collateral entering the system before it could be stopped."

LayerZero's own production guidance names this risk for LRTs: "The downstream blast radius of a forged mint is not bounded to your own protocol."

The recovery

Arbitrum's Security Council froze 30,766 ETH of the attacker's funds.
The DeFi United coalition formed to restore rsETH's backing. An April 24 Aave governance proposal asked for 25,000 ETH from the DAO treasury.
By May 9, liquidations had recovered 106,993 rsETH: 89,567 from Aave and 17,426 from Compound.
On June 1, Aave Labs reported ETH liquidity fully restored, with rsETH still frozen.

The Configuration Lesson

LayerZero and Kelp disagree on how the route came to rely on one DVN:

LayerZero: a previous 2-of-2 configuration "had been modified by the application owner to a 1-of-1." Its April 19 statement says it had shared DVN diversification best practices with Kelp.
Kelp: it told CoinDesk the setup "followed LayerZero's documented defaults," and that the compromised stack was LayerZero's own, as crypto.news reported.

Both accounts agree that one verifier guarded the route, and that its infrastructure was compromised.

Kelp was not alone. In April, Nexus Mutual cited Dune data putting 47% of LayerZero OApps on a 1-of-1 setup.

What has changed since, per LayerZero and Kelp:

LayerZero Labs' DVN refuses to sign as the only required DVN on any channel.
It now requires a quorum of independent RPC sources.
LayerZero said in May that protocol defaults would move to no less than 3-of-3 DVNs.
Kelp moved rsETH on Base, Mantle and Ink to Chainlink CCIP on October 5, 2026.

Whichever account is right, the lesson is to pin and check every route. LayerZero's docs warn that a side left on defaults inherits the chain's default DVN set, and LayerZero Labs "can change that default at any time without notice."

A route you have not pinned is a route someone else configures.

Checklist for LRT and OFT Teams

For token issuers

On every destination chain, read each route's receive config with getConfig(oApp, recvLib, srcEid, 2).
Require at least two DVNs from independent operators, with one not run by LayerZero Labs.
Pin DVNs, libraries and confirmations explicitly. An empty DVN list with a zero count means "use the default."
Check every route, not just the busy ones. Kelp's loss came through its Unichain route.
Put the owner and delegate on a multisig. The delegate controls setConfig.
Alert on every setConfig, setPeer and setDelegate call.
Reconcile the lockbox against remote supply and source nonces, and alert on any gap.
Cap what one message can release with inbound rate limits.
Keep a fast pause and a recipient freeze. Kelp's freeze stopped the second 40,000 rsETH release.

For lenders listing LRTs

Ask for each bridged collateral's DVN setup, chain by chain, before listing it.
Size caps and LTVs to the weakest route that can release or mint the token.
Plan for an oracle that keeps quoting the pre-exploit rate, as LlamaRisk warned for rsETH.

Our LayerZero OFT security checklist covers the contract side, and our time-to-detection report covers how fast teams pause.

How Guardian Verifies Configuration

Since February 2025, Guardian has checked USDT0's peers, DVN sets, confirmation counts and enforced gas for every pathway, per its USDT0 deployment verification case study.

That work spans 45+ engagements across 25+ chains on EVM, Solana and Stellar. The method is in our deployment verification checklist.

After launch, Managed Security reviews every multisig transaction before it is signed, and every deployment and configuration change as it lands.

Frequently Asked Questions

What caused the Kelp DAO hack?

LayerZero's report says attackers poisoned RPC nodes used by LayerZero Labs' DVN, the only verifier on Kelp's Unichain to Ethereum route. The DVN signed a forged message, releasing 116,500 rsETH on Ethereum. Its signing keys were not compromised.

Was the rsETH exploit a smart contract bug?

No. LayerZero found no protocol-level failure, Kelp says its rsETH contracts are intact, and LlamaRisk says Aave's contracts were never compromised. The route trusted one verifier, and that verifier was fed forged chain data.

What is a 1-of-1 DVN?

A LayerZero security stack with one required DVN and no optional DVNs. One attestation is enough to deliver a message, so compromising that verifier, its infrastructure or its RPC sources lets an attacker forge packets.

Did Aave take bad debt from the Kelp exploit?

Aave faced it. LlamaRisk estimated $123.7M to $230.1M, depending on how the loss was shared. By May 9, liquidations had recovered 106,993 rsETH, and the DeFi United coalition had committed ETH to cover the rest.

Sources

Check every route before it carries value

Guardian verifies peers, DVNs, roles and every queued transaction on each chain, the standard applied across USDT0's rollout.

Talk to Guardian Read the USDT0 case study