KelpDAO bridge vulnerability exploited, $292M in rsETH drained in single-verifier attack
A critical vulnerability in KelpDAO's cross-chain bridge has led to the theft of $292 million in rsETH, exposing significant flaws in decentralized finance (DeFi) security. As the fallout continues, investors must reassess their risk exposure in cross-chain protocols.
What Happened?
On April 18, 2026, a significant security breach occurred within KelpDAO, a decentralized finance (DeFi) platform. Attackers exploited a weakness in the platform's cross-chain bridge, draining approximately $292 million worth of rsETH, a token used within the KelpDAO ecosystem. This incident not only led to the loss of funds but also triggered a massive wave of withdrawals across various DeFi protocols, totaling over $10 billion in just a few hours.
The core issue stemmed from the reliance on a single verifier to authenticate transactions. This means that the entire system depended on one entity to confirm that transactions were legitimate. When the attackers forged a message indicating that a corresponding burn of rsETH had occurred on another blockchain, the single verifier approved the transaction without any additional checks, leading to the release of the funds.
Understanding Cross-Chain Bridges
To grasp the implications of this attack, it's essential to understand what cross-chain bridges are. These are systems that allow different blockchains to communicate and transfer assets between one another. In the case of KelpDAO, the bridge was designed to facilitate the movement of rsETH across different networks, enhancing liquidity and usability.
However, the design of KelpDAO's bridge included a critical flaw known as a 1-of-1 Decentralized Verifier Network (DVN). This means that only one validator was required to confirm a transaction. In traditional finance, this would be akin to having a single person responsible for approving all transactions, which poses a significant risk if that individual is compromised.
The Mechanics of the Attack
The attackers employed a sophisticated strategy that combined a supply chain compromise with a distributed denial-of-service (DDoS) attack. They first infiltrated LayerZero's internal infrastructure, which is responsible for processing transactions on the KelpDAO bridge. By replacing legitimate software with counterfeit versions, they were able to feed false information to the sole verifier.