$290M DeFi Exploit: LayerZero Points to Kelp Setup, Lazarus Suspected

A massive exploit tied to Kelp DAO has quickly become the largest DeFi hack of 2026, with roughly $290–$292 million drained from its cross-chain bridge. The incident is now sending shockwaves across decentralized finance, not just because of its size, but because of how it happened—and who may be behind it.

What Actually Happened

The attack targeted Kelp DAO’s bridge infrastructure, which allows assets like rsETH (a liquid restaking token) to move across more than 20 blockchain networks. An attacker managed to drain approximately 116,500 rsETH—around 18% of the token’s circulating supply—by tricking the system into approving a fraudulent cross-chain message.

This wasn’t a simple smart contract bug. Instead, the exploit manipulated the communication layer that verifies whether transactions between chains are legitimate. Once the system believed the fake message was real, it released funds directly to the attacker.

LayerZero’s Explanation

LayerZero, the interoperability protocol powering the bridge, has placed the blame squarely on Kelp DAO’s security configuration—not its own core technology.

According to its findings, Kelp was running a single-verifier setup, meaning only one entity was responsible for confirming cross-chain transactions. This created a critical “single point of failure.”

Attackers exploited this by compromising infrastructure tied to that verifier, including RPC nodes used to validate transactions. They fed false data to the system while simultaneously disrupting backup verification channels, effectively forcing the bridge to trust manipulated inputs.

LayerZero had previously recommended a multi-verifier model, which would require consensus across multiple independent validators—something that could have prevented the attack.

Lazarus Group Connection

LayerZero has preliminarily attributed the exploit to North Korea’s Lazarus Group, specifically its highly sophisticated TraderTraitor unit.

While definitive on-chain attribution remains difficult, the attack’s scale, coordination, and technical complexity closely match past Lazarus operations. The group has already been linked to multiple high-profile crypto exploits, and this incident adds to a growing pattern of targeted DeFi attacks in 2026.

Notably, this would mark more than $500 million drained by the same group in just a few weeks across different protocols, using entirely different attack vectors.

Market Fallout and Contagion Risk

The exploit didn’t stay contained. Because rsETH is widely used as collateral across DeFi platforms, the breach triggered immediate defensive actions across the ecosystem.

Major protocols froze markets, paused activity, and scrambled to assess exposure. Billions in liquidity were pulled from lending platforms as users rushed to reduce risk, highlighting just how interconnected DeFi has become.

This is the core issue: when one piece of infrastructure fails, it can ripple across dozens of protocols almost instantly.

The Bigger Takeaway

This wasn’t just another hack—it was a structural failure. The exploit exposed a fundamental risk in cross-chain architecture: trust assumptions.

A single misconfiguration, even on top of otherwise functional infrastructure, can open the door to catastrophic losses. In this case, the protocol itself may have worked as designed—but the way it was implemented created the vulnerability.

At the same time, the continued involvement of state-linked actors like Lazarus underscores a broader reality: crypto is no longer just battling bugs—it’s facing highly resourced, adaptive adversaries.

As DeFi continues to scale, the focus is shifting from innovation speed to security design. And after this exploit, one thing is clear—redundancy and verification layers are no longer optional.