kelpdao

Сообщение ChainCatcher, данные DefiLlama показывают, что второй квартал 2026 года стал самым активным периодом для криптохакерских атак за всю историю, с 83 независимыми атаками, что является историческим рекордом. Несмотря на рост частоты атак, общие потери за квартал составили около 755,3 миллиона долларов, что все еще ниже 3,56 миллиарда долларов в четвертом квартале 2020 года.Из них атака на KelpDAO на сумму 293 миллиона долларов и атака на Drift Protocol на сумму 280 миллионов долларов составили более трех четвертей от общих потерь за квартал. Кроссчейн-мосты стали основным источником потерь, связанные с атаками привели к краже около 351 миллиона долларов.Ранее в этом месяце Humanity Protocol понесла убытки в 36 миллионов долларов, Aztec Connect подвергся двум атакам на пассивные смарт-контракты, каждая из которых привела к потерям около 2,1 миллиона долларов, децентрализованная биржа Raydium подверглась атаке на 1,3 миллиона долларов в июне.

Сообщение ChainCatcher, Aave после атаки на кросс-цепочный мост rsETH KelpDAO в апреле 2026 года испытал вывод средств на сумму около 8,45 миллиарда долларов, но основные функции протокола не вышли из строя, успешно завершив одно из крупнейших в истории DeFi тестов на ликвидность. Эта кризисная ситуация возникла из-за атаки на кросс-цепочный мост LayerZero KelpDAO, в результате которой было украдено около 292 миллионов долларов rsETH, что вызвало опасения на рынке относительно стоимости и платежеспособности залога rsETH.Поскольку rsETH широко используется в таких протоколах, как Aave, в качестве залогового актива, риск быстро распространился, что привело к массовому выводу средств пользователями, в некоторых рынках коэффициент использования достигал 100%, и некоторые пользователи не могли немедленно вывести свои средства. В условиях нехватки ликвидности команда управления рисками Aave активировала механизм экстренной заморозки и корректировки параметров, чтобы ограничить распространение рисков.Основатель Aave Стани Кулечов рассматривает это событие как доказательство повышения зрелости DeFi, полагая, что протокол продолжает функционировать по проекту даже под экстремальным давлением, демонстрируя устойчивость системы, основанной на прозрачности и правилах. Однако несколько независимых аналитиков указывают на то, что, хотя Aave и избежал системного краха, событие выявило существующие риски концентрации, ликвидности и риски заражения, связанные с высокой взаимосвязанностью протоколов в системе DeFi. Поведение крупных заемщиков может оказать влияние на стабильность всей системы, превышающее ожидаемое по моделям.В настоящее время Aave контролирует риски с помощью многоуровневых мер защиты, таких как ограничение отношения займа к стоимости (LTV), пороги ликвидации, лимиты поставок, лимиты заимствования, режим изоляции, E-Mode и механизмы управления. Эти механизмы в целом сработали в кризисной ситуации, но наблюдатели считают, что скорость реакции управления и модели рисков все еще нуждаются в дальнейшей оптимизации для противодействия будущим неизвестным системным шокам.Анализ показывает, что это событие демонстрирует, что DeFi-протоколы могут выдерживать массовые выводы средств без внешней помощи, но одноразовое тестирование на давление не может полностью доказать безопасность системы. С увеличением совместимости между протоколами проблема с внешним активом или кросс-цепочным мостом все еще может быстро перерасти в кризис ликвидности для всей экосистемы.

According to The Block, since the KelpDAO cross-chain bridge attack in mid-April, the total value locked (TVL) in DeFi has decreased by about 14%, from approximately $172 billion to $148 billion. The attackers exploited vulnerabilities in off-chain infrastructure rather than smart contract vulnerabilities, stealing about $292 million and exposing new infrastructure risks.The outflow of funds has continued for more than five weeks, indicating that investors are broadly withdrawing marginal capital rather than just targeting specific protocols that were attacked. Lending, as the largest DeFi category, saw its locked amount decrease from about $53 billion to $40 billion, marking the largest decline. Liquidity re-staking protocols also experienced significant drops. The KelpDAO attack indicates that as the security of smart contracts improves, off-chain infrastructure is becoming a more easily exploitable attack surface.

According to official news, KelpDAO stated that the last batch of 20,373.72 rsETH has been transferred to the rsETH OFT adapter earlier, thus completing the operational part of the rsETH recovery plan. KelpDAO also attached the relevant transaction information.

LayerZero Labs released a report on the KelpDAO attack incident, confirming that the KelpDAO rsETH cross-chain bridge built on its cross-chain communication protocol was attacked, resulting in the theft of approximately 116,500 rsETH (about $292 million). Several security agencies, including Mandiant, CrowdStrike, and independent researchers, attributed the attack to the North Korean-related hacker group TraderTraitor (UNC4899).The report indicates that the attack began on March 6, 2026, when the attackers used social engineering techniques to compromise a LayerZero developer account, obtain session keys, and infiltrate the RPC cloud environment, further contaminating internal RPC node data and manipulating return results to deceive monitoring systems and the decentralized verification network (DVN).LayerZero Labs officially announced that it will adjust its security strategy, including no longer allowing its DVN to act as the sole signer in a single validation configuration, while also rebuilding the affected cloud infrastructure and introducing short-term credentials, instant permission upgrades, and multi-party approval mechanisms to enhance security.

According to CoinDesk, after KelpDAO was attacked resulting in a loss of $292 million, the industry's scrutiny of the security of cross-chain infrastructure continues to heat up, with approximately $4 billion in assets having completed or currently migrating from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP).The DeFi protocol Lombard is the latest project to join this migration trend. The protocol announced it would abandon LayerZero and migrate over $1 billion in Bitcoin-backed assets to Chainlink CCIP, stating that this decision stemmed from a comprehensive internal security review following the April attack incident.Lombard issues two types of Bitcoin-backed tokens—LBTC and BTC.b—and will prioritize the migration of assets on chains such as Solana, Etherlink, Berachain, Corn, and TAC, while terminating the use of LayerZero on Morph and Swell. Lombard stated that the reason for choosing CCIP is its independent node operators, built-in rate limiting mechanisms, and audited infrastructure. Additionally, the protocol will adopt Chainlink's cross-chain token standard to achieve asset cross-chain circulation through a burn-and-mint model.Previously, Kelp DAO, Solv Protocol, Re, and the cryptocurrency exchange Kraken have all completed similar migrations, with these projects collectively transferring approximately $4 billion in assets. Chainlink Labs Chief Business Officer Johann Eid stated, "We are witnessing a continued wave of risk-averse migration within the industry."

According to CoinDesk, Aave Labs will rewrite the asset listing and collateral risk control rules. In addition to the existing price and volatility assessments, new reviews will be added for compatibility, network security, and underlying architecture, and minimum standard guidelines will be published for asset issuers.This move stems from the KelpDAO cross-chain bridge attack in April, where hackers minted approximately $293 million worth of unbacked rsETH and borrowed real wETH on Aave as collateral, resulting in hundreds of millions of dollars in bad debt for the protocol. Aave will also shift from a single pool perspective to studying systemic connections between different DeFi protocols to reduce cross-protocol risks and is calling on other DeFi projects to follow similar standards.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.

According to The Block, North Korea has denied allegations of its involvement in cryptocurrency theft, calling the claims "absurd defamation" and a "political tool." The statement was released by state media, emphasizing that necessary measures will be taken to safeguard national interests.However, data from blockchain analysis firm TRM Labs shows that hacker groups associated with North Korea have stolen approximately $577 million, accounting for about 76% of global cryptocurrency theft losses during the same period. This includes two major attack incidents on KelpDAO (approximately $292 million) and Drift Protocol (approximately $285 million).TRM pointed out that the related attacks are mainly associated with the Lazarus Group and its sub-organizations. Since 2017, the cumulative scale of cryptocurrency theft linked to North Korea has exceeded $6 billion. U.S. and international agencies generally believe that such funds are used to support military and missile programs. Meanwhile, the U.S. Treasury has recently imposed sanctions on related individuals and entities, involving approximately $800 million in illegal fund flows for 2024.

KelpDAO has announced that it has completed its committed contribution to the recovery fund and has provided 2000 ETH in treasury funds to the DeFi United recovery plan led by Aave, aimed at restoring the peg support for rsETH and promoting the system's return to normal operation.This funding is a one-time investment intended to restore rsETH to its nominal exchange rate. Following the events of April 18, DeFi United, in collaboration with multiple ecosystem participants (including Mantle, Consensys, Arbitrum, Lido Finance, LayerZero, etc.), has formulated a recovery path that includes re-capitalization of the bridging treasury, restoration of oracle functionality, and addressing funding gaps in the affected markets.Kelp stated that its investment helps accelerate the overall repair process. Kelp emphasized that the internal commitment before any public statement is that "rsETH holders will not be abandoned," and noted that this contribution is a direct manifestation of that commitment.As funds from various parties gradually come into place, the collateral support for rsETH will gradually return to normal, and the company will continue to update the community on progress.

The latest report from blockchain intelligence agency TRM Labs shows that approximately 76% of global cryptocurrency hacking losses are related to organizations associated with North Korea, with a total stolen amount of about $577 million.North Korea's share of global crypto theft continues to rise: 22% in 2022, 37% in 2023, 39% in 2024, rising to 64% in 2025, and further increasing to 76% in 2026. Since 2017, the total illegal profits have exceeded $6 billion. The report points out that these losses mainly stem from two major incidents in April: a $292 million attack on KelpDAO and a $285 million theft from Drift Protocol, with the two attacks accounting for about 3% of all hacking incidents during the same period.

According to The Block, Standard Chartered's latest report points out that the theft of KelpDAO's rsETH, while causing a severe impact on the DeFi ecosystem, is not enough to change the long-term growth trend of real-world asset (RWA) tokenization.Geoffrey Kendrick, head of digital asset research at Standard Chartered, stated that this incident is more like DeFi being "bent, not broken," and may even become an important turning point for the industry towards a more resilient structure.Standard Chartered maintains its forecast: by the end of 2028, the RWA tokenization market size will grow from $35 billion in October 2025 to $2 trillion, with the core driving force still coming from the continued expansion of the DeFi banking system and stablecoin liquidity.

Aave, in collaboration with multiple institutions, has launched the "DeFi United" rescue plan to address the approximately $292 million loss caused by the KelpDAO vulnerability attack and to prevent the spread of bad debts.The attack originated from a vulnerability in the LayerZero integration, where hackers forged uncollateralized rsETH and borrowed approximately $190 million in assets on Aave, leading to collateral distortion and triggering a bank run, causing the platform's TVL to evaporate by about $10 billion at one point.Currently, Lido Finance, EtherFi, and founder Stani Kulechov have proposed funding plans; Arbitrum has frozen some funds, but the remaining assets have been transferred through THORChain, making recovery difficult. The current focus is on joint funding to "patch the holes" and stabilize the DeFi lending system.

The on-chain analysis platform Santiment tweeted that six days after the Kelp event outbreak, there were obvious signs of "refugee trade" in the market.The Spark token SPK skyrocketed from $0.029 to $0.058 within 48 hours, an increase of over 100%. Meanwhile, whale transactions (over $100,000) surged from an average baseline of about 30 per day to 183 today.In contrast, the price of the AAVE token continues to decline, currently hovering around $92, even though Bitcoin had previously broken through $79,000 earlier this week.Santiment pointed out that this event did not solely cause destruction but led to a reallocation of funds— a liquidity crisis for one protocol turned into a bull market for another protocol.Note: "Refugee trade" is a metaphorical term in the crypto/DeFi space, specifically referring to the phenomenon where funds flee in large amounts from damaged or high-risk protocols, similar to refugees, and move to another protocol that is relatively safe and lower risk.

According to official news, KelpDAO stated that over the past few days, the team has been continuously advancing the handling of related events with the support of partners, allies, and the community. Discussions are progressing in a positive direction, and efforts are being accelerated to reach a suitable solution. The project party emphasized that it always adheres to the core principle of "user first," and subsequent measures will be gradually implemented with the aim of safeguarding the overall interests of users.In the past four days, the Kelp team has been working around the clock in collaboration with multiple parties, maintaining close communication with all relevant parties, and making substantial progress on several potential solutions. This includes measures taken by the Arbitrum Security Council to freeze the stolen funds, as well as SEAL 911 participating in the preliminary investigation to provide objective and clear analytical support for the incident.Kelp stated that the current focus of work remains on protecting user asset security and strengthening the protocol itself. This incident is not only of critical significance to the project but also has enlightening value for the entire industry. The team will continue to disclose subsequent progress through official channels and thanks the ecological partners and community for their ongoing support.Previous reports indicated that the KelpDAO hacker has essentially laundered $175 million in ETH into BTC.

According to on-chain analyst Yu Jin's monitoring, within a day and a half, the KelpDAO hacker has exchanged nearly all of the 75,700 ETH (175 million USD) for BTC.The hacker mainly used the THORChain protocol for cross-chain exchanges, contributing 800 million USD in trading volume and 910,000 USD in platform fee revenue to THORChain.

According to monitoring by Shield, the KelpDAO attackers have begun to transfer the stolen assets: they transferred some of the stolen ETH from the Ethereum mainnet across to Arbitrum via the Across Protocol, then exchanged it for USDT, and routed it to the TRON DAO ecosystem through LayerZero.This path shows that the attackers are diversifying and laundering funds through multi-chain bridges and stablecoin conversion methods, and the subsequent flow of funds still needs to be continuously tracked.