KelpDAO Hit by $290 Million rsETH Theft; LayerZero Suspects Lazarus Group
Summary
LayerZero says preliminary indicators point to North Korea’s Lazarus Group (TraderTraitor) in KelpDAO’s reported $290–293 million rsETH theft, enabled by poisoned RPC data and DDoS against healthy nodes. KelpDAO paused contracts as an investigation continues.
Key points
- Blockchain activity showed about 116,500 rsETH, valued at roughly $293 million, stolen from KelpDAO.
- Attackers reportedly compromised RPC nodes used by the rsETH verifier and DDoS-ed healthy nodes, forcing reliance on falsified blockchain data.
- A forged cross-chain message was accepted as valid, enabling an unauthorized rsETH transfer.
- LayerZero said preliminary indicators point to North Korea’s Lazarus Group, specifically TraderTraitor; this attribution remains preliminary.
- KelpDAO paused rsETH contracts across Ethereum and L2s and began an investigation with LayerZero, Unichain, and other partners.
- The stolen funds passed through Tornado Cash. LayerZero said the incident was isolated to rsETH, with no broader contagion across other apps or assets.
- The report says Compound, Euler, and Aave were also affected; Aave announced a freeze blocking new deposits and borrowing with rsETH as collateral.
Article Details
- Victim Organization
- KelpDAO
- Incident Type
- Unauthorized cross-chain theft of rsETH after attackers compromised RPC nodes used by the verifier, supplied falsified blockchain data, and DDoS-ed healthy nodes to force reliance on poisoned nodes.
- Affected Data Size
- Approximately 116,500 rsETH, valued at about $290–293 million.
- Operational Impact
- KelpDAO paused rsETH contracts across Ethereum and L2s and began an investigation with LayerZero, Unichain, and other partners. The article says the attack reportedly also affected Compound, Euler, and Aave; Aave froze rsETH as collateral and blocked new deposits and borrowing using it.
- Claim Status
- confirmed
MITRE ATT&CK
T1498 · Network Denial of ServiceAttackers DDoS-ed healthy RPC nodes to force the verifier to rely on compromised, poisoned nodes.T1565.002 · Transmitted Data ManipulationAttackers supplied falsified blockchain data through compromised RPC nodes, causing a fake cross-chain message to be accepted as valid.
Threat Actors
Products
AaveThe attack reportedly also impacted the lending protocols Compound, Euler, and Aave, with the latter announcing a freeze and blocking new deposits or borrowing using rsETH as collateral.CompoundThe attack reportedly also impacted the lending protocols Compound, Euler, and Aave, with the latter announcing a freeze and blocking new deposits or borrowing using rsETH as collateral.EulerThe attack reportedly also impacted the lending protocols Compound, Euler, and Aave, with the latter announcing a freeze and blocking new deposits or borrowing using rsETH as collateral.LayerZeroThe attackers laundered funds through Tornado Cash, prompted rsETH contract freezes across Ethereum and L2s, and triggered an ongoing investigation by LayerZero and partners.rsETHNorth Korean state-sponsored hackers, likely the Lazarus Group (TraderTraitor), stole about 116,500 rsETH — roughly $290–293 million — from the KelpDAO DeFi project by poisoning RPC nodes to forge cross-chain messages.