Skip to content
CertGPS

KelpDAO Crypto-Heist

KelpDAO, a decentralized finance (DeFi) project, suffered a $290 million crypto-heist, with state-sponsored North Korean hackers likely behind the attack.

Severity awaiting reviewData breach
Incident date
Published
Read time
6 min
C
CertGPS

Not independently reviewed

AI-assisted content. Editorial policy · Suggest a correction

View source
On this page

Note: This analysis is based on publicly available information from source article. Facts are clearly separated from technical analysis.

Executive Summary

The KelpDAO Crypto-Heist incident is a high-severity data breach that occurred on April 18, 2026, affecting the Ethereum network and LayerZero. The attackers compromised the verification layer (DVN) used to validate cross-chain messages for rsETH, feeding falsified blockchain data to the verifier while simultaneously DDoS-ing healthy RPC nodes. This enabled the attackers to move rsETH without authorization, affecting 116,500 devices. The incident highlights the importance of robust security measures and the need for continuous monitoring and improvement.

What Happened: Timeline

✅ Verified Facts

  • April 18: KelpDAO detected suspicious cross-chain activity involving rsETH, forcing it to pause rsETH contracts across the Ethereum mainnet and L2s.
  • April 20: KelpDAO announced that it detected suspicious cross-chain activity involving rsETH, forcing it to pause rsETH contracts across the Ethereum mainnet and L2s.
  • April 20: LayerZero shared additional details about the attack.

Technical Deep Dive

Understanding Cross-Chain Messages

Cross-chain messages are a type of communication between different blockchain networks. They enable the transfer of assets between networks, allowing for greater flexibility and interoperability. However, this also introduces security risks, as malicious actors can exploit vulnerabilities in the verification process.

How does it work?

The verification process involves a series of checks to ensure that the cross-chain message is valid and authentic. This includes checking the sender's identity, the recipient's identity, and the asset being transferred. If any of these checks fail, the message is rejected.

Security considerations

The verification process is a critical component of cross-chain messaging. If an attacker can compromise the verification process, they can manipulate the message and steal assets. In the case of the KelpDAO Crypto-Heist, the attackers compromised the verification layer (DVN) used to validate cross-chain messages for rsETH.

Understanding RPC Nodes

RPC nodes are a type of node that provides a interface for interacting with a blockchain network. They enable developers to send requests to the network and receive responses. However, RPC nodes can also be used for malicious purposes, such as DDoS attacks.

How does it work?

RPC nodes receive requests from clients and forward them to the network. They then receive responses from the network and forward them back to the client. If an attacker can compromise an RPC node, they can manipulate the requests and responses, allowing them to steal assets.

Security considerations

RPC nodes are a critical component of a blockchain network. If an attacker can compromise an RPC node, they can manipulate the network and steal assets. In the case of the KelpDAO Crypto-Heist, the attackers DDoS-ed healthy RPC nodes to force the system to rely on compromised nodes.

Understanding DDoS Attacks

DDoS attacks are a type of cyber attack that involves overwhelming a network or system with traffic in order to make it unavailable. They can be used to disrupt a network or system, or to steal assets.

How does it work?

DDoS attacks involve sending a large amount of traffic to a network or system, overwhelming it and making it unavailable. This can be done using a variety of techniques, including botnets and amplification attacks.

Security considerations

DDoS attacks are a critical security risk for blockchain networks. If an attacker can launch a DDoS attack, they can disrupt the network and steal assets. In the case of the KelpDAO Crypto-Heist, the attackers DDoS-ed healthy RPC nodes to force the system to rely on compromised nodes.

Analysis: What Went Wrong

📊 Professional Analysis

Technical Root Cause

The technical root cause of the KelpDAO Crypto-Heist was the compromise of the verification layer (DVN) used to validate cross-chain messages for rsETH. This allowed the attackers to feed falsified blockchain data to the verifier, enabling them to move rsETH without authorization.

Contributing Factors

The contributing factors to the KelpDAO Crypto-Heist included the DDoS-ing of healthy RPC nodes, which forced the system to rely on compromised nodes. This allowed the attackers to manipulate the requests and responses, enabling them to steal assets.

Lessons for Security Professionals

Key Takeaways

  1. Implement robust security measures: Implementing robust security measures, such as multi-factor authentication and encryption, can help prevent attacks like the KelpDAO Crypto-Heist.
  2. Monitor and improve: Continuously monitoring and improving security measures can help prevent attacks like the KelpDAO Crypto-Heist.
  3. Use secure protocols: Using secure protocols, such as HTTPS, can help prevent attacks like the KelpDAO Crypto-Heist.

Prevention & Detection

How to Prevent

  • Implement robust security measures: Implementing robust security measures, such as multi-factor authentication and encryption, can help prevent attacks like the KelpDAO Crypto-Heist.
  • Monitor and improve: Continuously monitoring and improving security measures can help prevent attacks like the KelpDAO Crypto-Heist.
  • Use secure protocols: Using secure protocols, such as HTTPS, can help prevent attacks like the KelpDAO Crypto-Heist.

How to Detect

  • Monitor network traffic: Monitoring network traffic can help detect attacks like the KelpDAO Crypto-Heist.
  • Use intrusion detection systems: Using intrusion detection systems can help detect attacks like the KelpDAO Crypto-Heist.
  • Use security information and event management systems: Using security information and event management systems can help detect attacks like the KelpDAO Crypto-Heist.
View related certification topics

Security+

  • Network security: Understanding network security concepts, such as firewalls and intrusion detection systems, is relevant to the KelpDAO Crypto-Heist.
  • Cryptography: Understanding cryptography concepts, such as encryption and decryption, is relevant to the KelpDAO Crypto-Heist.

CySA+

  • Security operations: Understanding security operations concepts, such as incident response and threat hunting, is relevant to the KelpDAO Crypto-Heist.
  • Security analytics: Understanding security analytics concepts, such as threat intelligence and security information and event management, is relevant to the KelpDAO Crypto-Heist.

CEH

  • Network security: Understanding network security concepts, such as firewalls and intrusion detection systems, is relevant to the KelpDAO Crypto-Heist.
  • Cryptography: Understanding cryptography concepts, such as encryption and decryption, is relevant to the KelpDAO Crypto-Heist.

CISSP

  • Security and risk management: Understanding security and risk management concepts, such as risk assessment and mitigation, is relevant to the KelpDAO Crypto-Heist.
  • Asset security: Understanding asset security concepts, such as data classification and access control, is relevant to the KelpDAO Crypto-Heist.

OSCP

  • Penetration testing: Understanding penetration testing concepts, such as vulnerability assessment and exploitation, is relevant to the KelpDAO Crypto-Heist.
  • Security analysis: Understanding security analysis concepts, such as threat modeling and risk assessment, is relevant to the KelpDAO Crypto-Heist.

CISM

  • Information security governance: Understanding information security governance concepts, such as risk management and compliance, is relevant to the KelpDAO Crypto-Heist.
  • Information security program development and management: Understanding information security program development and management concepts, such as security policy and procedure development, is relevant to the KelpDAO Crypto-Heist.

CISA

  • Auditing and assurance: Understanding auditing and assurance concepts, such as risk assessment and audit planning, is relevant to the KelpDAO Crypto-Heist.
  • Information systems and technology: Understanding information systems and technology concepts, such as IT service management and IT governance, is relevant to the KelpDAO Crypto-Heist.

Source (1)

This analysis is based on: https://www.bleepingcomputer.com/news/security/kelpdao-suffers-290-million-heist-tied-to-lazarus-hackers/

This incident analysis is provided for educational purposes. Facts are cited from the source article, while technical analysis represents professional interpretation.