You Won’t Believe How $293M Disappeared in a Flash – KelpDAO Hack Explained!

by

So, picture this: $293 million goes poof, and suddenly Aave, rsETH holders, and the entire DeFi world are left with a gaping hole that resembles my social life on a Saturday night. Seriously, who knew crypto could be so dramatic?

Enter stage left, DeFiLlama co-founder 0xngmi, who decided to play the role of the rational adult in the room and laid out three delightfully messy options for cleaning up this financial disaster.

Three Scenarios, None of Them Clean

First up, we’ve got the classic “spread the pain” move. According to our hero 0xngmi, if KelpDAO decides to socialize losses among all users, we’re looking at a charming 18.5% haircut. And let’s be real, we’ve got about 666,000 rsETH just hanging out across Aave deployments like they’re on an extended vacation, but most of them are practically begging for liquidation. Who needs a spa day when you can just lose your investments instead?

Now, if we wipe out all equity in those positions, we’re staring down the barrel of roughly $216 million in bad debt. But fear not! Aave’s Umbrella ETH coverage can absorb a cozy $55 million, while the protocol’s treasury is willing to chip in another $85 million-leaving us a delightful gap of about $76 million. To cover this gap, 0xngmi suggests Aave could either take out a loan (because that’s always a great idea) or liquidate its AAVE treasury tokens, which are currently valued at around $51 million. What could go wrong?

Option two? Oh, it’s a doozy. Get ready for some good old-fashioned “rugging” of the rsETH holders on layer 2 chains. This would leave Aave with a staggering $359 million in rsETH supply, and assuming it’s all looped at maximum LTV, we’re talking about $341 million of bad debt across lending markets. And guess what? Umbrella’s not covering any of that mess. So, Aave gets to decide which markets get saved and which go down in flames-spoiler alert: Arbitrum, Mantle, and Base are probably the ones taking the biggest hits. Cheers!

The third option sounds fancy, but it’s a real brain teaser. It involves going back to a pre-hack snapshot and trying to make only the direct victims whole. That means coughing up $124 million that the hacker supposedly swiped from Aave plus an additional $18 million from Arbitrum. But here’s the kicker: the money has been doing the cha-cha around various pooled protocols, making it as easy to track as my ex on social media.

And just when you thought it couldn’t get any crazier, OneKey founder Yishi pops in with a fourth option that’s totally outside 0xngmi’s playbook: negotiate with the hacker first! Offer them a 10% to 15% bounty and hope to get most of the cash back before diving headfirst into the difficult decisions. If that flops, Yishi argues that LayerZero’s ecosystem fund should foot the bill, because why not let someone else deal with the mess?

How $293M Left in Two Transactions

Cyvers founder Meir Dolev took a deep dive into the on-chain timeline of the KelpDAO attack. Spoiler alert: it was a whirlwind! The attacker’s wallet got funded through Tornado Cash about 10 hours before the chaos ensued. Then, at precisely 17:35 UTC on April 18, two transactions occurred: commitVerification on LayerZero’s ReceiveUIn302, followed by IzReceive on EndpointV2 just 24 seconds later. That second gem drained 116,500 rsETH, which was approximately $293.5 million, in one fell swoop. Imagine doing that at the ATM!

KelpDAO’s multisig had the bright idea to blacklist the attacker’s recipient address on rsETH at 18:23 UTC, and surprisingly, it worked! A second attempt to snag another 40,000 rsETH (worth around $100 million) hit the blacklist and, poof! Reverted. No money for you!

According to Dolev, the root cause was as simple as pie: KelpDAO’s Unichain-to-Ethereum bridge only required one DVN attestation to release funds. Just one! Forging that single verification allowed the hacker to swipe $293 million like it was a last slice of pizza at a party.

LayerZero chimed in too, attributing the attack to the Lazarus Group’s TraderTraitor unit. They claimed the protocol worked perfectly as designed and pointed directly at KelpDAO’s 1-of-1 DVN configuration as the reason for the mess, noting they had previously advised everyone to use multi-DVN setups. Thanks for the heads-up, guys!

Security researcher Andy didn’t hold back, labeling KelpDAO’s choice to run a single DVN while holding $1.5 billion in user funds as “extremely irresponsible.” He added a little cherry on top by warning that dozens of other protocols are running the exact same risky setup right now. Good luck, folks!

Read More

2026-04-20 14:38