Arbitrum Freezes $71 Million in ETH Stolen in Kelp DAO Exploit

The Arbitrum Security Council froze $71 million in ETH stolen during a $292 million exploit of Kelp DAO's rsETH Liquid Restaking Token, which affected approximately 116,500 rsETH representing 18% of supply. The attack exploited a verification layer issue where one signature tricked LayerZero's cross-chain messaging into believing valid instructions had arrived, with LayerZero and Kelp DAO disputing whether the vulnerability was a protocol bug or configuration issue. The exploit triggered panic across DeFi, with Aave experiencing $6.2 billion in net outflows and its total value locked dropping from $26.4 billion to nearly $20 billion, while the AAVE token fell over 18%. Multiple protocols including Aave and Lido paused rsETH activity, and the incident follows a pattern of recent DeFi exploits including the $285 million Drift hack linked to North Korean actors.

The Kelp DAO exploit and immediate market impact

• ▪Arbitrum froze $71 million in ETH stolen in the Kelp DAO exploit
• ▪Approximately 116,500 rsETH, representing about 18% of supply, was affected in the Kelp DAO exploit
• ▪Kelp DAO's rsETH is a Liquid Restaking Token that allows users to earn ether staking and restaking rewards while keeping their assets liquid
• ▪The attacker tricked LayerZero's cross-chain messaging layer into believing a valid instruction had arrived from another network in the Kelp DAO exploit
• ▪The Kelp DAO exploit resulted in $292 million in losses

Technical root cause and cross-chain security vulnerabilities

• ▪The Kelp DAO exploit involved a verification layer issue rather than broken smart contracts
• ▪The Kelp DAO exploit was not a LayerZero protocol bug but a configuration issue
• ▪LayerZero's configuration can allow a 1/1 DVN setup where the DVN is a single node run by a single entity
• ▪A DVN in LayerZero V2 is an independent entity responsible for validating and attesting to the authenticity of messages sent across different blockchain networks
• ▪One signature enabled 116,500 rsETH to materialize out of thin air on Ethereum in the Kelp DAO exploit

Broader contagion effects across DeFi lending platforms

• ▪Aave's total value locked dropped from $26.4 billion on April 18 to nearly $20 billion on Sunday morning
• ▪The Kelp DAO exploit led to withdrawals across all lending protocols, including on Solana and unaffected protocols
• ▪Aave experienced negative net inflows of $6.2 billion, representing a 23% decline, following the Kelp DAO exploit
• ▪The AAVE token fell more than 18% as depositors scrambled to withdraw their money through the weekend

Industry response and ongoing investigation

• ▪At least a dozen smaller DeFi protocols were exploited in the weeks following the Drift hack, including CoW Swap, Zerion, Rhea Finance and Silo Finance
• ▪Justin Sun offered to negotiate with the Kelp DAO hacker to prevent Aave and Kelp DAO from going down
• ▪Kelp DAO paused rsETH contracts across mainnet and several L2s while investigating the exploit
• ▪Solana-based perpetuals protocol Drift was drained of about $285 million on April 1 in an attack linked to North Korea-affiliated actors
• ▪Stani Kulechov stated that the Kelp DAO exploit was external and that Aave's contracts were not compromised

Perspective of Kelp DAO

• ▪Kelp DAO is collaborating with LayerZero, Unichain, auditors, and security experts to determine the root cause of the $292 million exploit
• ▪Kelp DAO paused rsETH contracts across mainnet and several L2s while investigating the exploit

Perspective of Aave

• ▪Stani Kulechov stated that the Kelp DAO exploit was external and that Aave's contracts were not compromised