Kelp DAO Attributes $292 Million rsETH Exploit to LayerZero Labs Breach

By Patricia Miller

Apr 21, 2026

2 min read

Kelp DAO blames $292M rsETH exploit on LayerZero breach, linked to North Korea’s Lazarus Group, raising concerns on DeFi security.

#How Did Kelp DAO Attribute the $292 Million rsETH Exploit?

Kelp DAO has pointed to a breach in infrastructure at LayerZero Labs as the cause of the significant $292 million rsETH exploit. With the market reflecting a strong certainty of another hack exceeding $100 million by the end of the year, traders are interpreting this as a confirmation of ongoing vulnerabilities in the crypto sector. Analysts have tied the incident to the Lazarus Group, a hacking group linked to North Korea, notorious for cyber operations aimed at funding its regime.

The exploit unfolded on April 18, when compromised RPC nodes at LayerZero, combined with a DDoS attack, led to a failover involving unreliable verifiers. This breach resulted in a drainage of funds. Kelp acted swiftly, pausing contracts within 46 minutes, a measure that potentially saved an additional estimated loss of $200 million. Fortunately, LayerZero managed to restore its operations without compromising broader protocol integrity.

#What Does the Market Think About Future Crypto Hacks?

Currently, the market for the likelihood of another $100 million-plus crypto hack before December 31 stands firmly at 100% certainty. This marks a clear signal to traders who perceive it as definitive evidence of ongoing risks in the crypto landscape. The confirmed involvement of North Korea not only intensifies the situation but also introduces geopolitical considerations to an already alarming event, which marks the largest DeFi exploit of this year based on financial loss.

#Why Is This Most Recent Incident Important?

The exploit has highlighted a critical vulnerability within LayerZero's RPC node infrastructure, wherein a DDoS attack can trigger failovers to compromised verifiers. The implications of North Korea's involvement complicate the narrative, adding a layer of geopolitical concern to the largest DeFi hack by dollar amount in 2023. With the market assessing this at 100% certainty, holders of YES shares may find themselves without much upside, although those who invested before this occurrence are now in a position to gain maximum payouts.

Despite the hack, the Ethereum price markets for April 18 and April 19 have remained stable at a 100% YES prediction. The repercussions of the exploit primarily affect DeFi security, rather than directly influencing the price of ETH.

Moving forward, the need for official feedback from security firms such as CertiK and TRM Labs, coupled with additional insights from blockchain analytics firms like Chainalysis and Elliptic, will be crucial. Such findings could significantly alter how traders assess and price risks associated with DeFi infrastructure in the future.

Explore more on these topics:

Important Notice And Disclaimer

This article does not provide any financial advice and is not a recommendation to deal in any securities or product. Investments may fall in value and an investor may lose some or all of their investment. Past performance is not an indicator of future performance.