KelpDAO 2026 rsETH bridge RPC/DVN compromise
On April 18, 2026, attackers compromised LayerZero Labs internal RPC infrastructure and simultaneously disrupted an external RPC path. Poisoned RPC responses caused the sole LayerZero Labs DVN configured for KelpDAO’s rsETH OApp to attest to a forged cross-chain message. With a 1-of-1 DVN configuration, the destination accepted that attestation and released 116,500 rsETH on Ethereum even though no corresponding burn occurred on Unichain.
Incident facts
- Incident title
- KelpDAO 2026 rsETH bridge RPC/DVN compromise
- Bridge
- KelpDAO rsETH Bridge
- Incident date
- 2026-04-18
- Incident type
- Exploit
- Major incident
- Yes
- Affected chains
- Unknown, Ethereum
- Affected assets
- Unknown
- Attack category
- Relayer Or Oracle Issue
- Reported loss
- 116,500 rsETH (approximately $292 million)
- Amount confidence
- High
- Loss amount basis
- Reported By Project
- Recovery
- Unknown
- Reimbursement
- Unknown
- Restart
- Paused
- Current outcome
- Unknown
- Postmortem
- Available
- Resolution
- Unresolved
- Last reviewed
- 2026-09-09
- Last verified
- 2026-09-09
Amount and valuation
LayerZero’s final incident report states that 116,500 rsETH, approximately $292 million at the time of attack, was lost from the KelpDAO rsETH bridge.
USD value follows LayerZero Labs’ final incident report; rsETH is preserved as the exact token quantity in prose because BIR does not yet have an rsETH reference key.
116,500 rsETHapproximately $292 million
Direct report from the compromised DVN infrastructure operator.
Why this remains unresolved
- Final recovery of the 116,500 rsETH is not established by the admitted evidence.
- A completed reimbursement state is not established.
- A dated unrestricted reopening of the affected rsETH bridge path is not established.
Timeline events
Forged cross-chain message releases 116,500 rsETH on Ethereum2026-04-18
Poisoned LayerZero Labs RPC responses and denial of service against an external RPC path caused the sole configured LayerZero Labs DVN to attest to a forged Unichain-to-Ethereum message. The destination accepted the single attestation and released 116,500 rsETH without a corresponding source-chain burn.
Unichain and rsETH are preserved in prose because dedicated reference keys are absent.
KelpDAO pauses rsETH contracts during containment2026-04-18
KelpDAO acknowledged suspicious cross-chain activity and paused rsETH contracts across Ethereum mainnet and several L2s while working with LayerZero and security teams on root-cause analysis.
No unrestricted reopening is inferred.
LayerZero publishes final KelpDAO incident report2026-05-20
LayerZero Labs published its final incident report describing the March 6 social-engineering entry point, compromise of internal RPC nodes, DDoS-assisted failover, the 1-of-1 DVN configuration, and the forged attestation that enabled the April 18 bridge loss.
Publication of the report does not establish recovery or bridge reopening.
Evidence records
- KelpDAO Incident StatementLayerZero Labs · Tier 1 · High reliability · primary · 2026-04-19Claim scope: Incident Case
First-party statement from the compromised DVN infrastructure operator supporting the bridge-specific incident boundary, 1-of-1 DVN configuration, RPC poisoning, and approximately $290M impact.
- Kelp DAO’s rsETH bridge apparently exploited for roughly $292 million in LayerZero-based attackThe Block · Tier 1 · High reliability · secondary · 2026-04-18Claim scope: Event
Contemporaneous independent report quoting KelpDAO’s acknowledgement and pause of rsETH contracts across mainnet and several L2s.
- LayerZero Labs KelpDAO Incident ReportLayerZero Labs · Tier 1 · High reliability · primary · 2026-05-20Claim scope: Incident Case
First-party final incident report from the compromised DVN infrastructure operator supporting 116,500 rsETH / approximately $292M, RPC compromise, DDoS failover, 1-of-1 configuration and forged attestation.
- KelpDAO Incident StatementLayerZero Labs · Tier 1 · High reliability · primary · 2026-04-19Claim scope: Event
First-party statement from the compromised DVN infrastructure operator supporting KelpDAO acknowledgement and the pause of rsETH contracts during containment.
Source tiers describe evidence authority, not certainty for every claim. Tier 1 is the strongest source class; Tier 2 and Tier 3 provide progressively more secondary or supporting context. Source notes define what each record actually supports.
Known unknowns
- Final recovered amount and reimbursement state remain unresolved.
- The admitted evidence does not establish a dated unrestricted reopening.
Help maintain incident aftermath records
Support recovery, reimbursement, restart, migration, shutdown, evidence, and correction checks.
Report a correction
Report missing evidence, incorrect dates, outcome changes, recovery details, reimbursement status, or broken links. GitHub Issues are preferred for structured review; the Google Form is available if you do not use GitHub.