kelpdao

Tin tức từ ChainCatcher, dữ liệu từ DefiLlama cho thấy quý II năm 2026 đã trở thành thời điểm có nhiều cuộc tấn công hacker tiền điện tử nhất được ghi nhận, với tổng cộng 83 sự kiện tấn công độc lập, lập kỷ lục mới. Mặc dù tần suất tấn công tăng lên, tổng thiệt hại trong quý này khoảng 755,3 triệu USD, vẫn thấp hơn 3,56 tỷ USD của quý IV năm 2020.Trong đó, cuộc tấn công 293 triệu USD vào KelpDAO và cuộc tấn công 280 triệu USD vào Drift Protocol chiếm hơn ba phần tư tổng thiệt hại của quý này. Cầu nối chuỗi là nguồn thiệt hại lớn nhất, các cuộc tấn công liên quan đã dẫn đến khoảng 351 triệu USD bị đánh cắp.Vào đầu tháng này, Humanity Protocol đã mất 36 triệu USD, Aztec Connect đã gặp hai cuộc tấn công vào hợp đồng thông minh thụ động, mỗi cuộc tấn công thiệt hại khoảng 2,1 triệu USD, sàn giao dịch phi tập trung Raydium đã gặp cuộc tấn công 1,3 triệu USD vào tháng 6.

Tin tức từ ChainCatcher, Aave đã trải qua khoảng 8.45 tỷ USD rút vốn sau khi cầu nối rsETH của KelpDAO bị tấn công vào tháng 4 năm 2026, nhưng các chức năng cốt lõi của giao thức không gặp sự cố, thành công hoàn thành một trong những bài kiểm tra áp lực thanh khoản lớn nhất trong DeFi cho đến nay. Cuộc khủng hoảng này bắt nguồn từ việc cầu nối đa chuỗi LayerZero của KelpDAO bị tấn công, khoảng 292 triệu USD rsETH đã bị đánh cắp, gây ra lo ngại trên thị trường về giá trị tài sản thế chấp của rsETH và khả năng thanh toán.Do rsETH được sử dụng rộng rãi trong các giao thức như Aave làm tài sản thế chấp, rủi ro nhanh chóng lan rộng, dẫn đến việc người dùng rút vốn tập trung, một số thị trường đã đạt tỷ lệ sử dụng 100% trong một thời điểm, một số người dùng không thể ngay lập tức rút tiền. Đối mặt với tình trạng thanh khoản căng thẳng, đội ngũ quản lý rủi ro của Aave đã khởi động cơ chế đóng băng khẩn cấp và điều chỉnh tham số để hạn chế sự lan rộng của rủi ro.Người sáng lập Aave, Stani Kulechov, coi sự kiện này là bằng chứng cho sự trưởng thành của DeFi, cho rằng giao thức vẫn hoạt động theo thiết kế dưới áp lực cực đoan, thể hiện tính bền bỉ của hệ thống minh bạch và quy tắc điều khiển trên chuỗi. Tuy nhiên, nhiều nhà phân tích độc lập chỉ ra rằng, mặc dù Aave đã tránh được sự sụp đổ hệ thống, nhưng sự kiện này đã phơi bày ra rằng hệ thống cho vay DeFi vẫn tồn tại rủi ro tập trung, rủi ro thanh khoản và rủi ro lây lan do sự liên kết cao giữa các giao thức. Hành vi của những người vay lớn có thể ảnh hưởng đến sự ổn định của toàn bộ hệ thống vượt quá dự đoán của mô hình.Hiện tại, Aave kiểm soát rủi ro thông qua nhiều biện pháp bảo vệ như giới hạn tỷ lệ giá trị khoản vay (LTV), ngưỡng thanh lý, giới hạn cung cấp, giới hạn vay, Chế độ cách ly, Chế độ E và cơ chế quản trị. Những cơ chế này đã phát huy tác dụng trong cuộc khủng hoảng lần này, nhưng các quan sát viên cho rằng, tốc độ phản ứng của quản trị và mô hình rủi ro vẫn cần được tối ưu hóa hơn nữa để đối phó với các cú sốc hệ thống chưa biết trong tương lai.Phân tích cho rằng, sự kiện này cho thấy các giao thức DeFi có thể chịu đựng được sự rút vốn quy mô lớn mà không cần cứu trợ bên ngoài, nhưng một bài kiểm tra áp lực đơn lẻ không thể hoàn toàn chứng minh tính an toàn của hệ thống. Khi tính khả thi giữa các giao thức ngày càng tăng, một vấn đề về tài sản bên ngoài hoặc cầu nối đa chuỗi vẫn có thể nhanh chóng biến thành cuộc khủng hoảng thanh khoản của toàn bộ hệ sinh thái.

According to The Block, since the KelpDAO cross-chain bridge attack in mid-April, the total value locked (TVL) in DeFi has decreased by about 14%, from approximately $172 billion to $148 billion. The attackers exploited vulnerabilities in off-chain infrastructure rather than smart contract vulnerabilities, stealing about $292 million and exposing new infrastructure risks.The outflow of funds has continued for more than five weeks, indicating that investors are broadly withdrawing marginal capital rather than just targeting specific protocols that were attacked. Lending, as the largest DeFi category, saw its locked amount decrease from about $53 billion to $40 billion, marking the largest decline. Liquidity re-staking protocols also experienced significant drops. The KelpDAO attack indicates that as the security of smart contracts improves, off-chain infrastructure is becoming a more easily exploitable attack surface.

According to official news, KelpDAO stated that the last batch of 20,373.72 rsETH has been transferred to the rsETH OFT adapter earlier, thus completing the operational part of the rsETH recovery plan. KelpDAO also attached the relevant transaction information.

LayerZero Labs released a report on the KelpDAO attack incident, confirming that the KelpDAO rsETH cross-chain bridge built on its cross-chain communication protocol was attacked, resulting in the theft of approximately 116,500 rsETH (about $292 million). Several security agencies, including Mandiant, CrowdStrike, and independent researchers, attributed the attack to the North Korean-related hacker group TraderTraitor (UNC4899).The report indicates that the attack began on March 6, 2026, when the attackers used social engineering techniques to compromise a LayerZero developer account, obtain session keys, and infiltrate the RPC cloud environment, further contaminating internal RPC node data and manipulating return results to deceive monitoring systems and the decentralized verification network (DVN).LayerZero Labs officially announced that it will adjust its security strategy, including no longer allowing its DVN to act as the sole signer in a single validation configuration, while also rebuilding the affected cloud infrastructure and introducing short-term credentials, instant permission upgrades, and multi-party approval mechanisms to enhance security.

According to CoinDesk, after KelpDAO was attacked resulting in a loss of $292 million, the industry's scrutiny of the security of cross-chain infrastructure continues to heat up, with approximately $4 billion in assets having completed or currently migrating from LayerZero to Chainlink's Cross-Chain Interoperability Protocol (CCIP).The DeFi protocol Lombard is the latest project to join this migration trend. The protocol announced it would abandon LayerZero and migrate over $1 billion in Bitcoin-backed assets to Chainlink CCIP, stating that this decision stemmed from a comprehensive internal security review following the April attack incident.Lombard issues two types of Bitcoin-backed tokens—LBTC and BTC.b—and will prioritize the migration of assets on chains such as Solana, Etherlink, Berachain, Corn, and TAC, while terminating the use of LayerZero on Morph and Swell. Lombard stated that the reason for choosing CCIP is its independent node operators, built-in rate limiting mechanisms, and audited infrastructure. Additionally, the protocol will adopt Chainlink's cross-chain token standard to achieve asset cross-chain circulation through a burn-and-mint model.Previously, Kelp DAO, Solv Protocol, Re, and the cryptocurrency exchange Kraken have all completed similar migrations, with these projects collectively transferring approximately $4 billion in assets. Chainlink Labs Chief Business Officer Johann Eid stated, "We are witnessing a continued wave of risk-averse migration within the industry."

According to CoinDesk, Aave Labs will rewrite the asset listing and collateral risk control rules. In addition to the existing price and volatility assessments, new reviews will be added for compatibility, network security, and underlying architecture, and minimum standard guidelines will be published for asset issuers.This move stems from the KelpDAO cross-chain bridge attack in April, where hackers minted approximately $293 million worth of unbacked rsETH and borrowed real wETH on Aave as collateral, resulting in hundreds of millions of dollars in bad debt for the protocol. Aave will also shift from a single pool perspective to studying systemic connections between different DeFi protocols to reduce cross-protocol risks and is calling on other DeFi projects to follow similar standards.

In response to KelpDAO's accusations against LayerZero regarding the rsETH security incident, LayerZero CEO Bryan Pellegrino tweeted a detailed response, stating that much of the content is completely false.Bryan pointed out that KelpDAO initially used LayerZero's default MultiDVN or DeadDVN configuration and later manually migrated to the 1/1 configuration; under the 1/1 configuration, almost 100% of the transaction volume came from rsETH; LayerZero's documentation repeatedly states that the 1/1 configuration is not recommended for production environments and provides specific transaction records and document screenshots as evidence.

According to The Block, North Korea has denied allegations of its involvement in cryptocurrency theft, calling the claims "absurd defamation" and a "political tool." The statement was released by state media, emphasizing that necessary measures will be taken to safeguard national interests.However, data from blockchain analysis firm TRM Labs shows that hacker groups associated with North Korea have stolen approximately $577 million, accounting for about 76% of global cryptocurrency theft losses during the same period. This includes two major attack incidents on KelpDAO (approximately $292 million) and Drift Protocol (approximately $285 million).TRM pointed out that the related attacks are mainly associated with the Lazarus Group and its sub-organizations. Since 2017, the cumulative scale of cryptocurrency theft linked to North Korea has exceeded $6 billion. U.S. and international agencies generally believe that such funds are used to support military and missile programs. Meanwhile, the U.S. Treasury has recently imposed sanctions on related individuals and entities, involving approximately $800 million in illegal fund flows for 2024.

KelpDAO has announced that it has completed its committed contribution to the recovery fund and has provided 2000 ETH in treasury funds to the DeFi United recovery plan led by Aave, aimed at restoring the peg support for rsETH and promoting the system's return to normal operation.This funding is a one-time investment intended to restore rsETH to its nominal exchange rate. Following the events of April 18, DeFi United, in collaboration with multiple ecosystem participants (including Mantle, Consensys, Arbitrum, Lido Finance, LayerZero, etc.), has formulated a recovery path that includes re-capitalization of the bridging treasury, restoration of oracle functionality, and addressing funding gaps in the affected markets.Kelp stated that its investment helps accelerate the overall repair process. Kelp emphasized that the internal commitment before any public statement is that "rsETH holders will not be abandoned," and noted that this contribution is a direct manifestation of that commitment.As funds from various parties gradually come into place, the collateral support for rsETH will gradually return to normal, and the company will continue to update the community on progress.

The latest report from blockchain intelligence agency TRM Labs shows that approximately 76% of global cryptocurrency hacking losses are related to organizations associated with North Korea, with a total stolen amount of about $577 million.North Korea's share of global crypto theft continues to rise: 22% in 2022, 37% in 2023, 39% in 2024, rising to 64% in 2025, and further increasing to 76% in 2026. Since 2017, the total illegal profits have exceeded $6 billion. The report points out that these losses mainly stem from two major incidents in April: a $292 million attack on KelpDAO and a $285 million theft from Drift Protocol, with the two attacks accounting for about 3% of all hacking incidents during the same period.

According to The Block, Standard Chartered's latest report points out that the theft of KelpDAO's rsETH, while causing a severe impact on the DeFi ecosystem, is not enough to change the long-term growth trend of real-world asset (RWA) tokenization.Geoffrey Kendrick, head of digital asset research at Standard Chartered, stated that this incident is more like DeFi being "bent, not broken," and may even become an important turning point for the industry towards a more resilient structure.Standard Chartered maintains its forecast: by the end of 2028, the RWA tokenization market size will grow from $35 billion in October 2025 to $2 trillion, with the core driving force still coming from the continued expansion of the DeFi banking system and stablecoin liquidity.

Aave, in collaboration with multiple institutions, has launched the "DeFi United" rescue plan to address the approximately $292 million loss caused by the KelpDAO vulnerability attack and to prevent the spread of bad debts.The attack originated from a vulnerability in the LayerZero integration, where hackers forged uncollateralized rsETH and borrowed approximately $190 million in assets on Aave, leading to collateral distortion and triggering a bank run, causing the platform's TVL to evaporate by about $10 billion at one point.Currently, Lido Finance, EtherFi, and founder Stani Kulechov have proposed funding plans; Arbitrum has frozen some funds, but the remaining assets have been transferred through THORChain, making recovery difficult. The current focus is on joint funding to "patch the holes" and stabilize the DeFi lending system.

The on-chain analysis platform Santiment tweeted that six days after the Kelp event outbreak, there were obvious signs of "refugee trade" in the market.The Spark token SPK skyrocketed from $0.029 to $0.058 within 48 hours, an increase of over 100%. Meanwhile, whale transactions (over $100,000) surged from an average baseline of about 30 per day to 183 today.In contrast, the price of the AAVE token continues to decline, currently hovering around $92, even though Bitcoin had previously broken through $79,000 earlier this week.Santiment pointed out that this event did not solely cause destruction but led to a reallocation of funds— a liquidity crisis for one protocol turned into a bull market for another protocol.Note: "Refugee trade" is a metaphorical term in the crypto/DeFi space, specifically referring to the phenomenon where funds flee in large amounts from damaged or high-risk protocols, similar to refugees, and move to another protocol that is relatively safe and lower risk.

According to official news, KelpDAO stated that over the past few days, the team has been continuously advancing the handling of related events with the support of partners, allies, and the community. Discussions are progressing in a positive direction, and efforts are being accelerated to reach a suitable solution. The project party emphasized that it always adheres to the core principle of "user first," and subsequent measures will be gradually implemented with the aim of safeguarding the overall interests of users.In the past four days, the Kelp team has been working around the clock in collaboration with multiple parties, maintaining close communication with all relevant parties, and making substantial progress on several potential solutions. This includes measures taken by the Arbitrum Security Council to freeze the stolen funds, as well as SEAL 911 participating in the preliminary investigation to provide objective and clear analytical support for the incident.Kelp stated that the current focus of work remains on protecting user asset security and strengthening the protocol itself. This incident is not only of critical significance to the project but also has enlightening value for the entire industry. The team will continue to disclose subsequent progress through official channels and thanks the ecological partners and community for their ongoing support.Previous reports indicated that the KelpDAO hacker has essentially laundered $175 million in ETH into BTC.

According to on-chain analyst Yu Jin's monitoring, within a day and a half, the KelpDAO hacker has exchanged nearly all of the 75,700 ETH (175 million USD) for BTC.The hacker mainly used the THORChain protocol for cross-chain exchanges, contributing 800 million USD in trading volume and 910,000 USD in platform fee revenue to THORChain.

According to monitoring by Shield, the KelpDAO attackers have begun to transfer the stolen assets: they transferred some of the stolen ETH from the Ethereum mainnet across to Arbitrum via the Across Protocol, then exchanged it for USDT, and routed it to the TRON DAO ecosystem through LayerZero.This path shows that the attackers are diversifying and laundering funds through multi-chain bridges and stablecoin conversion methods, and the subsequent flow of funds still needs to be continuously tracked.