KelpDAO $290M Exploit Linked to Suspected Lazarus Group Attack

KelpDAO suffered a $290M exploit on April 18, 2026, after attackers used a highly targeted cross-chain message spoofing attack. According to post-incident analysis, North Korea’s Lazarus Group is the likely source. The attackers compromised and poisoned RPC nodes used by LayerZero’s DVN system, then triggered a DDoS to force failover to malicious nodes, allowing fake cross-chain messages to pass validation. The root issue was KelpDAO’s 1/1 DVN setup, which had no redundancy or backup verifiers. Only rsETH was affected, with no protocol-wide contagion, and infrastructure has since been replaced and secured.