# Kelp DAO rsETH bridge exploit (Sentora-linked contagion): Kelp DAO rsETH bridge exploit: 116,500 unbacked rsETH (~$292M) minted, spreading stress through EVM lending
Source page: https://vaultx.llc/hacks/kelp-exploit-tied-to-sentora · VaultX incident report by Sentinel · first published 2026-11-06, updated 2026-11-06
- Date: 2026-04-18
- Reported loss: $292M (Reported about $292M for 116,500 rsETH; some sources give $291M or round to $290M/$293M. Downstream DeFi outflows reported at $10.9B (Sentora, five days), $11.7B (Sentora writeup) and over $13B TVL (CoinDesk, two days). Not independently verified.)
- Attribution: unknown in the provided research text. A CoinDesk URL slug in the research reads 'layerzero-blames-kelp-s-setup...attributes-it-to-north-korea-s-lazarus', suggesting LayerZero reportedly attributed the attack to North Korea's Lazarus Group, but the article body was not reviewed and no law-enforcement attribution is in the research.
- Chains: Ethereum, Unichain, EVM lending markets
- Status: contained
- Severity: 85/100
- Response score: 60/100 (An emergency pause was reportedly executed within about an hour, and the company has pursued legal action; however, the research shows no full post-mortem, compensation plan or verified recovery.)
According to Sentora, attackers exploited Kelp DAO's rsETH cross-chain bridge on April 18, 2026, minting 116,500 unbacked rsETH reported at about $292M. Rather than selling on DEXs, the attackers reportedly deposited the tokens into lending protocols and used rsETH's 1:1 oracle peg to ETH to borrow assets. Sentora and secondary outlets report large DeFi outflows in the days that followed, though the figures differ by source.

**What happened**
On April 18, 2026, attackers reportedly minted and used 116,500 rsETH, worth about $292M at the time, after bypassing Kelp DAO's cross-chain verification path, according to Sentora.
According to Sentora, the attackers deposited much of the unbacked rsETH into lending protocols instead of dumping it on DEXs, which Sentora says would have caused slippage and alerted MEV bots.
Sentora characterized the event as a localized bridge failure that triggered a much larger DeFi liquidity shock across EVM lending markets, with reported withdrawals of $10.9B over five days (about 21% of lending TVL) in one Sentora figure and $11.7B in another.
CoinDesk reported that DeFi TVL dropped by more than $13B over two days following the hack. Coverage names Aave, Euler and Morpho/Sentora strategies among affected venues or data sources.
According to the AltcoinBuzz URL in the research, KelpDAO has sued LayerZero and an individual named Pellegrino over the rsETH exploit.

**How it worked**
According to Sentora, attackers bypassed the 1-of-1 DVN (decentralized verifier network) and the bridge then accepted a forged cross-chain message.
Hypernative's reconstruction says the Ethereum-side rsETH adapter released 116,500 rsETH in response to a cross-chain message that never existed on Unichain. Hypernative's writeup is titled as a 'observation layer exploit'.
The minted rsETH was then used as collateral. Because rsETH is pegged 1:1 to ETH in the oracle used by lending protocols, the attackers could borrow real assets against unbacked tokens, which spread stress across lending markets.

**Where the money went**
Not established in the research. The research says the attackers used rsETH as collateral in lending protocols to borrow other assets, but it gives no verified address-level path, mixer use, bridge hops, exchange deposits, or frozen or recovered amounts.

**The response**
Kelp DAO reportedly triggered an emergency pause at about 18:21 UTC on April 18, 2026, per one reconstruction. Sentora published a research analysis and weekly digest on the contagion. KelpDAO reportedly filed a lawsuit against LayerZero and Pellegrino, per the AltcoinBuzz URL. The research does not describe a full remediation or compensation plan.

**Impact**
The primary loss is about $292M in unbacked rsETH. Secondary impact on lending markets is reported at $10.9B to over $13B in outflows or TVL decline, depending on source and methodology. Sentora calls this a liquidity shock with contagion across EVM lending protocols. Individual user losses are not quantified in the research.

**Timeline**
- 2026-04-18 17:35 UTC Main attack reportedly occurred, per one reconstruction cited in the research.
- 2026-04-18 18:21 UTC Kelp DAO emergency pause reportedly followed, per one reconstruction.
- 2026-04-18 Exploit date: 116,500 rsETH minted and used; Sentora later described it as a localized bridge failure.
- 2026-04-20 CoinDesk reported DeFi TVL falling by more than $13B over two days following the hack.

**How to protect yourself**
- Cross-chain bridges with a single verifier (such as a 1-of-1 DVN) create single points of failure; check the verifier configuration of any bridged asset you hold.
- Liquid restaking and bridged tokens used as lending collateral can spread a single bridge failure across many protocols; check oracle pegs and collateral concentration.
- If a bridged token's peg depends on an oracle, a forged mint can become borrowable value before the market reacts.
- Figures for the same incident differ by source and methodology; compare the primary post-mortem with secondary reports before relying on a single number.

**Still unknown**
- Full post-mortem from KelpDAO or LayerZero and the verified root cause of the forged message.
- Whether the attribution to Lazarus Group (reportedly by LayerZero) is confirmed, and by which evidence.
- Address-level laundering path, mixer use and cross-chain hops for the stolen funds.
- Amounts frozen, recovered or compensated, and the outcome of the KelpDAO lawsuit.
- Final verified loss and contagion figures, since $291M, $292M and $293M and $10.9B to $13B+ are all reported.
- Whether a second attempt of about $95M, mentioned in one earlier draft, was actually detected and blocked; this is not supported by the research notes.
- Exact attacker addresses. An earlier draft cited an address, but it is not in the research notes and was not verified, so it is excluded here.

**Sources**
- Sentora research: Ecosystem stress test, the Kelp DAO contagion https://sentora.com/research/articles/ecosystem-stress-test-the-kelp-dao-contagion-defi-united
- Sentora weekly digest https://sentora.com/research/articles/weekly-digest
- Crypto.news on Sentora's figures https://crypto.news/binance-hack-defi-outflows-kelp-comparison/
- AltcoinBuzz: KelpDAO sues LayerZero and Pellegrino over $292M rsETH exploit https://www.altcoinbuzz.io/kelpdao-sues-layerzero-and-pellegrino-over-292m-rseth-exploit
- Hypernative: The KelpDAO observation layer exploit, $291M released on a message that never existed https://www.hypernative.io/insights/blog/the-kelpdao-observation-layer-exploit-291m-released-on-a-message-that-never-existed
- CoinDesk: DeFi TVL drops more than $13 billion in two days following Kelp DAO hack https://www.coindesk.com/markets/2026/04/20/defi-tvl-drops-more-than-usd13-billion-in-two-days-following-kelp-dao-hack
- CoinInsider: KelpDAO hack triggers $13B DeFi TVL drop https://www.coininsider.org/news/kelpdao-hack-triggers-13b-defi-tvl-drop/

---
VaultX: free crypto news and intelligence, https://vaultx.llc