The KelpDAO Exploit

Bridge Forgery, Lending Loop, and Cascade Effects

Note for the reader: This article traces and analyses the economic exploit. For a whole overview on the technical exploit check our full paper

The Bridge Forgery

On April 18, 2026, at 17:35 UTC, LayerZero's v2 Endpoint contract on Ethereum mainnet processed a cross-chain message authorizing the release of 116,500 rsETH (valued at $294M at the exploit block) to a freshly created wallet. No corresponding deposit had been made on any source chain. The message was fabricated.

The KelpDAO and LayerZero incident statements attribute the forgery to a compromise of two RPC nodes serving the LayerZero Labs Decentralized Verifier Network (DVN). According to those statements, the attacker replaced op-geth binaries on both nodes and configured them to return forged transaction data to the DVN's query address while returning accurate data to every other IP. A simultaneous DDoS attack against the uncompromised redundant nodes forced the DVN to fail over to the poisoned infrastructure. The malicious binaries were set to self-destruct after the attack window closed. The forensic logs, network traffic captures, and binary signatures underlying these claims have not been published. Independent verification of the described attack path is not possible from publicly available data, and attribution to the Lazarus Group rests on the statements of the affected parties and their disclosed engagement with law enforcement.

One structural fact is verifiable from on-chain state: KelpDAO operated a 1-of-1 DVN configuration, with the LayerZero Labs DVN as the sole verifier of cross-chain messages for rsETH. LayerZero's published integration guidance recommends a multi-DVN setup requiring consensus among independent verifiers. A forged message passing through one compromised verifier is blocked by any second independent verifier operating under consensus requirements. Under a 1-of-1 configuration, no such check exists

The Distribution and Lending Loop

The 116,500 rsETH landed at an intermediary wallet (0x8b1b6c9a) that had zero prior activity and no activity after the seven-minute window in which it operated. The wallet distributed the full balance across eight transactions (one inbound, seven outbound) before going permanently silent. Outbound amounts, verified against transaction receipts, sum to exactly 116,500 rsETH (Dataset D).

The primary lending position (wallet 0x1f4c1c2e on Aave v3) deposited 53,000 rsETH and borrowed 52,440.58 WETH across four supply and four borrow transactions executed within five minutes. The borrow-to-collateral value ratio was 98.9% of the allowable maximum. Aave's eMode for ETH-correlated assets permits a 93% loan-to-value (LTV) ratio and a 95% liquidation threshold. The position was constructed at the maximum permissible LTV (Dataset B).

The second lending position (wallet 0xeba786c9 on Compound v3's cWETHv3 market) supplied 26,000 rsETH, subsequently withdrew 13,573 rsETH, and left 12,427 rsETH as net collateral backing 11,967.95 WETH in outstanding debt. The buffer above the liquidation threshold was 3.8%. A third, smaller Aave position (wallet 0x8d11aeac) replicated the same structure at lower scale: 400 rsETH against 393.9 WETH borrowed.

The four remaining wallets did not interact with lending protocols during the monitored window. Two of them (0x1b748b68 and 0xe9e2f48b) forwarded their rsETH to an aggregating address (0xacddac6c), which in turn returned it to the original source address (0x85d456b2). Three interpretations are plausible from the transaction record: the wallets were unused backup paths, the rsETH was being cycled to obscure the total minted volume, or the tokens were queued for re-bridging to mask the balance deficit on the origin chain. None of these interpretations can be confirmed from the available data (Dataset A).

Routing the extraction through lending markets rather than exchange sales has a mechanical rationale. Secondary liquidity for rsETH on DEXs was insufficient to absorb $294M without substantial price impact. Borrowing against an oracle-priced collateral position requires no market counterparty at the borrow step and produces no price slippage there. The cost of the lending route is the margin withheld as collateral, approximately 7% of total position value, representing the gap between the 93% LTV ratio and full collateral extraction. This cost is lower than the expected slippage on a direct market sale of $294M in a thin liquidity pool.

The Convergence

Five of the seven fan-out wallets sent their borrowed ETH to a single externally-owned account (0x5d3919f1) within approximately 55 minutes of the initial mint.

The collector address (0x5d3919f1) is a plain externally-owned account. No smart contract controls, time-locks, or multi-signature requirements apply. As of the April 20 snapshot, no outgoing transactions have been recorded.

The Cascade

At 17:00 UTC on April 18, Aave v3 recorded $121.6M in WETH borrows against a baseline of $1-5M per hour in the preceding 48 hours. Withdrawal volume rose to $42M at 18:00 UTC and to $678M across 324 transactions at 19:00 UTC. Four consecutive hours through midnight each exceeded 100 withdrawal transactions. The post-exploit movement data for the twenty largest WETH depositors shows one address pulling $100M in USDC and $32M in USDT within the 19:00 hour alone (Dataset G).

The exhaustion of withdrawal capacity follows from a specific contract mechanic. Pool.withdraw burns the caller's aToken and transfers the underlying asset from the pool's physical reserve. If the reserve does not hold the requested amount, the call reverts. At 100% utilization, the reserve is effectively empty. Depositors who moved before the reserve was drawn down exited at face value; those who arrived after found all withdrawal calls reverting regardless of their aToken balance.

As of the April 20 snapshot, WETH, USDT, and USDC are at 100% utilization on Aave v3 mainnet. USDe reached 99.5% and DAI 94.3%. Aggregate stuck capital is approximately $4.9B in stablecoins and $5.9B in WETH at the aToken level. Governance has frozen both the rsETH and WETH reserves, blocking new supplies and borrows but not unlocking existing deposits.

Users holding ETH-looping positions at the time of the exploit (collateral in wstETH or other liquid staking tokens, with WETH debt borrowed against it) faced elevated borrow rates of approximately 8-10% annualized as of April 18, with no functioning unwind path. The standard unwind route requires selling collateral to repay debt and then withdrawing the remainder. Both steps failed concurrently: rsETH and WETH secondary markets lacked liquidity for sales at scale, and WETH pool withdrawals reverted. The duration of the stalemate is material: each hour the positions remain open, the interest differential erodes collateral equity, increasing the probability of bad debt from positions that had no involvement in the original exploit.

The Liquidation Arithmetic

The main Aave position (0x1f4c1c2e) holds 53,000 rsETH against 52,459.30 WETH in outstanding debt (the original 52,440.58 WETH borrowed plus 18.72 WETH accrued over two days). The health factor at the April 20 snapshot is 1.0266, placing the position 2.66% above the liquidation threshold. rsETH has declined 11% against ETH over 2.5 days, from $2,527 at the exploit block to $2,315 at the snapshot block. The collateral-to-debt ratio at current prices is approximately 1.08. A liquidator claiming the 10% liquidation bonus recovers 110 units of WETH equivalent in rsETH in exchange for repaying 100 units of WETH debt, but only if the seized rsETH can be sold at or near the oracle price. If the oracle price is stale or secondary market depth is insufficient, the recovered value falls short of the bonus, and the delta accrues as bad debt.

At $121M in outstanding debt, a realized shortfall of 2% (the approximate gap between the current collateral/debt ratio and the required liquidation bonus) produces approximately $2.4M in bad debt per partial liquidation cycle. This figure grows with each downward tick in rsETH before the position is resolved. The Compound v3 position (0xeba786c9) presents the same structure at smaller scale: $28.77M in rsETH collateral against $27.72M in WETH debt, with a 3.8% buffer remaining. Neither position has recorded a single repayment transaction since the initial borrows (Dataset E).

Anomalous Exit Behavior During Protocol Freeze

As a personal experience (a member of MigaLabs), after the governance freeze of the WETH and rsETH markets, a small ETH supply position on Aave was managed in the following way: The standard withdrawal interface returned a near-zero amount consistent with a reverted Pool.withdraw call (the popup value was 0.006 ETH, not the actual balance), but the swap interface remained active and functional. By executing a series of swaps alternating between USDC and BTC across several transactions, we were able to exit the position and recover approximately 97% of the original ETH value. The situation begs the question: Does this represent intended protocol behavior or an unintended routing gap? The experience was not isolated: other users reported needing to take loans against their stuck assets to exit Aave, whereas this exit required no new debt position.

Two distinct contract paths operate here. Pool.withdraw burns the caller's aToken and moves the underlying from the pool's physical reserve; it reverts when the reserve is empty. aToken.transfer, by contrast, updates balance entries in the aToken contract's internal mapping without touching the reserve at all. aTokens are standard ERC-20 tokens with interest-accrual mechanics layered on top, and their transfer function carries no pool liquidity check. When a user swaps aTokens on a DEX (for example, via a Uniswap or Curve pool holding both aUSDC and underlying USDC), they are selling a claim on the pool's future liquidity to a buyer who accepts the illiquidity risk at a discount. The underlying reserve balance does not change.

If the swap interface in this case routed through aToken-denominated DEX pools rather than through Pool.withdraw, the behavior is documented Aave functionality, not a protocol error. The approximately 3% loss we accepted corresponds to the prevailing secondary market discount on aETHWETH tokens during the freeze period. The mechanism was not prominently communicated to depositors, and the information asymmetry between users who attempted and succeeded with the swap path and those who only attempted direct withdrawal is itself a material consequence of the freeze. Whether Aave's Umbrella backstop system had any effect on this routing is unclear. Umbrella is a governance-activated reserve deficiency mechanism, not a swap router, and its activation would not directly enable or suppress aToken transfers. A governance parameter change during the freeze window could, in principle, have affected related routing logic, but this requires inspection of the specific governance transactions executed in the hours following the exploit.

What Aave v4 Changes

Aave v4, which launched March 30, 2026, uses a Hub-and-Spoke architecture. A Liquidity Hub holds the physical assets. Spokes define borrowing rules with explicit draw caps, a governance-set ceiling on how much of any given asset a Spoke can pull from the Hub.

Under this model, an rsETH-collateralized Spoke with a draw cap of $50 million could not have generated $121 million in bad WETH debt regardless of how much rsETH was deposited. The draw cap enforces the limit at the Hub level before any borrow executes.

The bank-run pathway also works differently. Spoke utilization affects only that Spoke's draw from the Hub, not the Hub's availability to other Spokes. Governance terminating the rsETH Spoke would not require freezing the WETH or USDC reserves at all.

This does not address the upstream bridge failure. Multi-DVN configurations with independent verifiers would have blocked the forged message before any rsETH was minted. The Hub-and-Spoke model addresses the lending-layer contagion; a hardened DVN configuration prevents the forgery.

Open Questions

Where did the forged message originate on the source chain? The first on-chain touchpoint is the LayerZero Endpoint contract at block 24,908,285. The described off-chain compromise, including RPC node access, binary substitution, DDoS execution, and self-destruct cleanup, predates any logged on-chain event. The evidence underlying the Lazarus Group attribution has been shared with law enforcement but has not been published. Independent verification of the attack methodology is not currently possible.

Who bears the $175M in unbacked rsETH collateral? Socializing the loss across all rsETH holders (at a total rsETH supply of approximately $1.6B) would price rsETH at roughly 81.25% of its pre-exploit value. That repricing would simultaneously push existing rsETH-backed lending positions below their liquidation thresholds, generating a second wave of bad debt unconnected to the original exploit. Isolating the loss to L2 rsETH holders, whose tokens were on the bridge's destination chain at the time of the exploit, transfers the entire burden to users whose only distinguishing characteristic is where they held their tokens at that moment.

Will the collector wallet move, and through which channels? The 75,700.61 ETH in address 0x5d3919f1 has not moved in more than two days. The account is a plain EOA with no contract-level restrictions. The Lazarus Group's documented exit methodology involves cross-chain hops, mixing protocols, and peel-chain atomization. As of the April 20 snapshot, none of these movement patterns have appeared on-chain. Exchanges have been notified, and Seal911 is tracking the address per the KelpDAO incident statement.