{"id":41623,"date":"2026-04-21T11:45:58","date_gmt":"2026-04-21T11:45:58","guid":{"rendered":"https:\/\/cryptomag.finance\/?p=41623"},"modified":"2026-04-21T11:45:58","modified_gmt":"2026-04-21T11:45:58","slug":"massive-290000000-crypto-hack-on-kelpdao-likely-the-work-of-north-koreas-lazarus-group-layerzero","status":"publish","type":"post","link":"https:\/\/cryptomag.finance\/?p=41623","title":{"rendered":"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero"},"content":{"rendered":"

\"\"<\/p>\n

The total value locked on decentralized lending platform Aave is plunging after hackers exploited KelpDAO\u2019s cross-chain rsETH configuration, with LayerZero saying preliminary indicators point to North Korea\u2019s Lazarus Group.<\/p>\n

LayerZero says<\/a> KelpDAO was exploited for about $290 million on April 18 and describes the attacker as a \u201chighly-sophisticated state actor,\u201d likely tied to Lazarus Group and its TraderTraitor unit.<\/p>\n

In a statement, LayerZero says the incident was limited to KelpDAO\u2019s rsETH setup and did not spread to other assets or applications using the protocol.<\/p>\n

According to blockchain tracker LookonChain, the exploit led to roughly $292 million worth of rsETH being minted illegitimately. The attacker then used the token as collateral to borrow more than 82,600 Ether (ETH), worth about $195 million, from Aave.<\/p>\n

LookonChain says the bad debt triggered large withdrawals from Aave, causing its TVL to fall by $6.28 billion in less than 48 hours, from $26.396 billion to $20.114 billion.<\/p>\n

It says major withdrawals include $431 million from MEXC, $405.7 million from wallet 0x7CD0, possibly linked to Nonco, and $392 million from Abraxas Capital.<\/p>\n

LayerZero says the attack targeted downstream RPC infrastructure used by its Decentralized Verifier Network rather than exploiting the LayerZero protocol itself, adding that compromised nodes had been replaced and the verifier network was back online.<\/p>\n

Aave moved to freeze rsETH markets on V3 and V4 to prevent additional borrowing and deposits while it evaluates options to cover any deficit.<\/p>\n

Follow us on X<\/a>, Facebook<\/a> and Telegram<\/a><\/span><\/em>
\n
\nDon’t Miss a Beat \u2013 Subscribe<\/a> to get email alerts delivered directly to your inbox <\/span><\/em>
\n
\nSurf The Daily Hodl Mix<\/a><\/span><\/em>
\n<\/p>\n

\n
<\/div>\n

&nbsp<\/p>\n

Disclaimer: Opinions expressed at The Daily Hodl are not investment advice. Investors should do their due diligence before making any high-risk investments in Bitcoin, cryptocurrency or digital assets. Please be advised that your transfers and trades are at your own risk, and any losses you may incur are your responsibility. The Daily Hodl does not recommend the buying or selling of any assets including cryptocurrencies, nor is The Daily Hodl an investment advisor. Please note that The Daily Hodl participates in affiliate marketing.<\/h6>\n<\/div>\n

Generated Image: Midjourney<\/em><\/span><\/p>\n

The post Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero<\/a> appeared first on The Daily Hodl<\/a>.<\/p>","protected":false},"excerpt":{"rendered":"

The total value locked on decentralized lending platform Aave is plunging after hackers exploited KelpDAO\u2019s cross-chain rsETH configuration, with LayerZero saying preliminary indicators point to North Korea\u2019s Lazarus Group. LayerZero says KelpDAO was exploited for about $290 million on April 18 and describes the attacker as a \u201chighly-sophisticated state actor,\u201d likely tied to Lazarus Group […]<\/p>\n","protected":false},"author":1,"featured_media":41624,"comment_status":"","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"footnotes":""},"categories":[],"tags":[],"class_list":["post-41623","post","type-post","status-publish","format-standard","has-post-thumbnail"],"yoast_head":"\nMassive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero - Cryptomag<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cryptomag.finance\/?p=41623\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero - Cryptomag\" \/>\n<meta property=\"og:description\" content=\"The total value locked on decentralized lending platform Aave is plunging after hackers exploited KelpDAO\u2019s cross-chain rsETH configuration, with LayerZero saying preliminary indicators point to North Korea\u2019s Lazarus Group. LayerZero says KelpDAO was exploited for about $290 million on April 18 and describes the attacker as a \u201chighly-sophisticated state actor,\u201d likely tied to Lazarus Group […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cryptomag.finance\/?p=41623\" \/>\n<meta property=\"og:site_name\" content=\"Cryptomag\" \/>\n<meta property=\"article:published_time\" content=\"2026-04-21T11:45:58+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/dailyhodl.com\/wp-content\/uploads\/2025\/06\/attack-hack-alleged.jpg?resize=1024,600\" \/>\n<meta name=\"author\" content=\"Crypto Magazine\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:site\" content=\"@cryptomagz\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Crypto Magazine\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623\"},\"author\":{\"name\":\"Crypto Magazine\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"headline\":\"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero\",\"datePublished\":\"2026-04-21T11:45:58+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623\"},\"wordCount\":380,\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/attack-hack-alleged-cU4ysb.webp\",\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623\",\"name\":\"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero - Cryptomag\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/attack-hack-alleged-cU4ysb.webp\",\"datePublished\":\"2026-04-21T11:45:58+00:00\",\"author\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/cryptomag.finance\\\/?p=41623\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623#primaryimage\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/attack-hack-alleged-cU4ysb.webp\",\"contentUrl\":\"https:\\\/\\\/cryptomag.finance\\\/wp-content\\\/uploads\\\/attack-hack-alleged-cU4ysb.webp\",\"width\":1024,\"height\":600},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/?p=41623#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cryptomag.finance\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#website\",\"url\":\"https:\\\/\\\/cryptomag.finance\\\/\",\"name\":\"Cryptomag\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/cryptomag.finance\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cryptomag.finance\\\/#\\\/schema\\\/person\\\/f749cd846c4f13ef717c12a20ce9d040\",\"name\":\"Crypto Magazine\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g\",\"caption\":\"Crypto Magazine\"},\"sameAs\":[\"https:\\\/\\\/cryptomag.finance\",\"https:\\\/\\\/x.com\\\/cryptomagz\"],\"url\":\"https:\\\/\\\/cryptomag.finance\\\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero - Cryptomag","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cryptomag.finance\/?p=41623","og_locale":"en_US","og_type":"article","og_title":"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero - Cryptomag","og_description":"The total value locked on decentralized lending platform Aave is plunging after hackers exploited KelpDAO\u2019s cross-chain rsETH configuration, with LayerZero saying preliminary indicators point to North Korea\u2019s Lazarus Group. LayerZero says KelpDAO was exploited for about $290 million on April 18 and describes the attacker as a \u201chighly-sophisticated state actor,\u201d likely tied to Lazarus Group […]","og_url":"https:\/\/cryptomag.finance\/?p=41623","og_site_name":"Cryptomag","article_published_time":"2026-04-21T11:45:58+00:00","og_image":[{"url":"https:\/\/dailyhodl.com\/wp-content\/uploads\/2025\/06\/attack-hack-alleged.jpg?resize=1024,600","type":"","width":"","height":""}],"author":"Crypto Magazine","twitter_card":"summary_large_image","twitter_creator":"@cryptomagz","twitter_site":"@cryptomagz","twitter_misc":{"Written by":"Crypto Magazine","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/cryptomag.finance\/?p=41623#article","isPartOf":{"@id":"https:\/\/cryptomag.finance\/?p=41623"},"author":{"name":"Crypto Magazine","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"headline":"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero","datePublished":"2026-04-21T11:45:58+00:00","mainEntityOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=41623"},"wordCount":380,"image":{"@id":"https:\/\/cryptomag.finance\/?p=41623#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/attack-hack-alleged-cU4ysb.webp","inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/cryptomag.finance\/?p=41623","url":"https:\/\/cryptomag.finance\/?p=41623","name":"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero - Cryptomag","isPartOf":{"@id":"https:\/\/cryptomag.finance\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cryptomag.finance\/?p=41623#primaryimage"},"image":{"@id":"https:\/\/cryptomag.finance\/?p=41623#primaryimage"},"thumbnailUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/attack-hack-alleged-cU4ysb.webp","datePublished":"2026-04-21T11:45:58+00:00","author":{"@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040"},"breadcrumb":{"@id":"https:\/\/cryptomag.finance\/?p=41623#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cryptomag.finance\/?p=41623"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cryptomag.finance\/?p=41623#primaryimage","url":"https:\/\/cryptomag.finance\/wp-content\/uploads\/attack-hack-alleged-cU4ysb.webp","contentUrl":"https:\/\/cryptomag.finance\/wp-content\/uploads\/attack-hack-alleged-cU4ysb.webp","width":1024,"height":600},{"@type":"BreadcrumbList","@id":"https:\/\/cryptomag.finance\/?p=41623#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cryptomag.finance\/"},{"@type":"ListItem","position":2,"name":"Massive $290,000,000 Crypto Hack on KelpDAO Likely the Work of North Korea\u2019s Lazarus Group: LayerZero"}]},{"@type":"WebSite","@id":"https:\/\/cryptomag.finance\/#website","url":"https:\/\/cryptomag.finance\/","name":"Cryptomag","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cryptomag.finance\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/cryptomag.finance\/#\/schema\/person\/f749cd846c4f13ef717c12a20ce9d040","name":"Crypto Magazine","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/2c24e7a3322cdb9140c7dde381c870ae2c527e0dc5af67ed7a7db042bb2e1d14?s=96&d=mm&r=g","caption":"Crypto Magazine"},"sameAs":["https:\/\/cryptomag.finance","https:\/\/x.com\/cryptomagz"],"url":"https:\/\/cryptomag.finance\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/41623","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=41623"}],"version-history":[{"count":0,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/posts\/41623\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=\/wp\/v2\/media\/41624"}],"wp:attachment":[{"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cryptomag.finance\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}