18 Apr 2026
KelpDAO rsETH: Forged Bridge Packet Released 116,500 rsETH
KelpDAO: on 18 Apr 2026 a forged cross-chain packet accepted by third-party bridge verification released 116,500 rsETH from the Ethereum lockbox. Kelp says mainnet backing and the rsETH contract remain intact.
- Event date
- Incident typeBridge verification compromise
- Bug classThird-party access
- Published
Loss, as sourced
116,500 rsETH released from the Ethereum bridge lockbox, per KelpDAO. LayerZero's statement describes the incident as approximately $290M and attributes it to compromise of RPC infrastructure used by the LayerZero Labs DVN under Kelp's 1-of-1 DVN config.
Traceability
Primary sources
- 01blogs.kerneldao.comKelp DAO Incident Response, 19 Apr 2026 (opens in a new tab)
- 02layerzero.networkLayerZero KelpDAO Incident Statement, 19 Apr 2026 (opens in a new tab)
In brief
Root cause: Per Kelp: compromise outside Kelp's domain in bridge verification infrastructure. Per LayerZero: RPC poisoning plus DDoS failover caused the Labs DVN to attest a forged message; Kelp rsETH used a single-DVN (1/1) configuration contrary to LayerZero's multi-DVN recommendation.
Timeline, as sourced: Per LayerZero: 18 Apr exploit; affected RPCs deprecated and replaced; Labs DVN restored. Per Kelp: statement 19 Apr.
Account, as sourced
Claimed (Kelp) (response (opens in a new tab)): no infinite-mint; EigenLayer deposits intact; mainnet rsETH holders need no action.
Claimed (LayerZero) (statement (opens in a new tab)): zero contagion to other OFTs/OApps; will not attest 1/1 configs going forward.
Unknown: Kelp's full RCA from the infrastructure provider.
Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.
Permalinkhttps://andromeda.observer/e/kelpdao-rseth-bridge-dvn-2026