KelpDAO

2023-01-01

KelpDAO founded by Amitej Gajjala and Dheeraj Borra (also co-founders of Stader Labs); protocol launches rsETH as a liquid restaking token on EigenLayer.

2026-03-06

A LayerZero Labs developer is socially engineered into cloning a malicious GitHub repository, installing FLATROOF and ROOFDECK malware on a company device. Attackers harvest session keys for LayerZero's RPC cloud infrastructure and begin poisoning internal RPC nodes — the start of the preparation phase for the exploit.

2026-04-18

At 17:35 UTC, attackers execute the exploit. Poisoned RPC nodes feed false burn data to LayerZero's 1-of-1 DVN; the DVN confirms a fabricated cross-chain message and KelpDAO's bridge releases 116,500 rsETH (~$292 million) to attacker-controlled addresses. Attackers deposit ~90,000 stolen rsETH into Aave as collateral and borrow ~$190 million in ETH and other assets.

2026-04-18

At 18:21 UTC, KelpDAO's emergency pauser multisig freezes the protocol's core contracts 46 minutes after the drain, blocking two subsequent attack attempts estimated at a further $95 million.

2026-04-19

Aave freezes rsETH markets on V3 and V4. SparkLend and Fluid suspend trading. Lido Finance pauses earnETH deposits. AAVE token falls approximately 10%.

2026-04-20

LayerZero publicly attributes the attack with preliminary confidence to North Korea's Lazarus Group (TraderTraitor / UNC4899) and blames KelpDAO's 1-of-1 DVN configuration. KelpDAO disputes the framing, arguing LayerZero approved the setup and bears responsibility for its own infrastructure failures.

2026-04-20

DeFi TVL drops $13.21 billion in 48 hours, from $99.497 billion to $86.286 billion. Aave alone loses $8.45 billion in deposits. At least nine DeFi protocols are directly affected.

2026-04-21

Arbitrum Security Council freezes 30,766 ETH (~$71 million) linked to the KelpDAO exploit in coordination with law enforcement. An Arbitrum DAO emergency vote updates sequencer filtering to prevent the funds from being bridged out.

2026-04-23

Aave founder Stani Kulechov launches the DeFi United coalition to restore rsETH backing and prevent broader contagion.

2026-04-27

DeFi United discloses over $300 million in pledges (132,706 ETH) from ecosystem participants including Consensys (30,000 ETH), Mantle (30,000 ETH), Aave DAO (25,000 ETH pending), EtherFi (5,000 ETH), Stani Kulechov (5,000 ETH), Lido (2,500 stETH), and KelpDAO itself (2,000 ETH).

2026-05-01

The U.S. District Court for the Southern District of New York issues a restraining order blocking Arbitrum DAO from releasing or moving the frozen 30,766 ETH. North Korea terrorism judgment creditors (Han Kim, Yong Seok Kim) invoked the Foreign Sovereign Immunities Act and Terrorism Risk Insurance Act.

2026-05-05

KelpDAO formally claims that LayerZero approved the 1-of-1 DVN configuration that enabled the exploit and announces migration of rsETH bridge infrastructure to Chainlink CCIP.

2026-05-09

LayerZero issues a revised public statement acknowledging: 'We made a mistake by allowing our DVN to act as a 1/1 DVN for high-value transactions' and accepting shared responsibility for the exploit.

2026-05-18

LayerZero publishes its full incident report, confirming the March 6 social engineering breach, the FLATROOF/ROOFDECK malware installation, and the detail that KelpDAO had downgraded from a 2-of-2 to a 1-of-1 DVN configuration prior to the exploit. Mandiant and CrowdStrike corroborate DPRK TraderTraitor attribution.

2026-05-25

KelpDAO and Aave jointly announce completion of the rsETH recovery phase. KelpDAO transfers a final tranche of 20,373.72 rsETH into the OFT adapter, restoring rsETH backing above 100% (dashboard shows 100.01%). Full minting, redemption, and reward operations resume.