Kelp DAO bridge exploit tied to Lazarus triggers DeFi losses, legal fight, and migration

Attackers linked with North Korea’s Lazarus Group exploited Kelp DAO’s LayerZero-powered rsETH bridge by compromising off-chain verification infrastructure and abusing a 1-of-1 DVN setup, fraudulently releasing about 116,500 rsETH worth roughly $292 million. The stolen tokens were posted as collateral on Aave to borrow real assets, creating an estimated $124 million to $230 million in bad debt, driving severe liquidity stress, and contributing to a broader DeFi selloff. Kelp DAO and LayerZero publicly disputed responsibility after LayerZero first blamed Kelp’s configuration, then later acknowledged its own mistake in allowing its DVN to operate as the sole verifier for a high-value route; a later forensic report said the intrusion began with social engineering of a LayerZero developer and was attributed with high confidence to DPRK-linked TraderTraitor/UNC4899.

Arbitrum’s Security Council froze about 30,766 ETH—roughly $71 million—linked to the exploit, but the recovery effort became entangled in U.S. litigation after terrorism-judgment creditors sought to seize the assets as alleged North Korean property. A federal judge later allowed an Arbitrum DAO vote to move the frozen ETH to Aave LLC while preserving the restraining notice, leaving ownership unresolved as DeFi United worked to recapitalize rsETH, Kelp burned attacker-held tokens on Arbitrum, and most of the remaining $220 million in unfrozen funds were reportedly laundered through THORChain, Wasabi, Tornado Cash, and Umbra. In the aftermath, Kelp migrated rsETH bridging to Chainlink CCIP, and the incident accelerated broader protocol moves away from minimal LayerZero verifier configurations.