Kelp DAO bridge exploit on 2026-04-18 ($292M reported)
Bridge exploit on Ethereum, 18 Apr 2026. Reported loss $292M. Last verified 4 Nov 2026.
critical
Reported loss
$292M
as reported by the sources
Recovered
-
nothing reported
Status
Unknown
updated 26 Oct 2026
Date
Ethereum
Summary
On 2026-04-18 a forged cross-chain message was accepted by the Kelp DAO rsETH bridge built on LayerZero, releasing 116,500 rsETH (about $292 million) from the Ethereum lockbox to an attacker. LayerZero Labs said investigators attribute the attack to the North Korean actor TraderTraitor.
- Protocol
- Kelp DAO
- Type
- Bridge exploit
- Reported loss
- $292,000,000 · as stated: 116,500 rsETH source: layerzero.network ↗
Facts and where they come from
| Fact | Value | Source |
|---|---|---|
| Date | April 18, 2026 | layerzero.network ↗ |
| Amount | 116,500 rsETH | blogs.kerneldao.com ↗ |
| Amount (USD) | approximately $292 million | layerzero.network ↗ |
| Attribution | DPRK threat actor TraderTraitor (UNC4899) | layerzero.network ↗ |
Primary sources
- LayerZero Labs: KelpDAO incident report ↗ post-mortem · accessed 2026-11-04
- Kelp DAO: incident response ↗ official announcement · accessed 2026-11-04
Our own summary of facts published by the sources above. We do not attribute fault beyond them. Amounts are as the sources state them (no USD conversion by us); links and quoted figures last checked 2026-11-04.
Get the next one first
- Alert on new security incidents: hacks, depegs, TVL drops and exchange outflows, by e-mail or Telegram