KelpDAO Aave $292 million LayerZero bridge exploit Lazarus Group North Korea DeFi United rescue April 2026
Hack
DeFi’s $292M KelpDAO Stress Test: Standard Chartered Says ‘Bent Not Broken,’ JPMorgan Disagrees

At 17:35 UTC on April 18, 2026, an attacker tied to North Korea’s Lazarus Group sent a single forged cross-chain message through KelpDAO’s LayerZero bridge. The bridge accepted it, releasing 116,500 rsETH tokens, roughly 18% of the entire restaked-Ethereum supply,…