Aave TVL Remains 43% Below Pre-KelpDAO Hack Levels Four Months After $292M Exploit
The April 18, 2026 exploit of KelpDAO ranks as the most expensive DeFi hack of the year. North Korea’s Lazarus Group executed the attack through a vulnerability in KelpDAO’s LayerZero bridge integration.
The attack vector targeted LayerZero’s Omnichain Fungible Token adapter, which was configured with a 1-of-1 DVN (Decentralized Verifier Network) configuration—a single verifier approving cross-chain messages without additional validation. This configuration deviated from LayerZero’s recommended 2-of-2 standard.
The attacker submitted a forged inbound data packet that minted 116,500 unbacked rsETH tokens, valued at approximately $292 million at the time of the exploit. The minting occurred without corresponding token burns or locks on the source chain.
The attacker deposited approximately 89,567 rsETH—worth roughly $221 million—into Aave V3 markets on Ethereum and Arbitrum as collateral. The attacker then borrowed approximately 82,650 WETH (about $191 million) and smaller amounts of wstETH against this impaired collateral. These positions maintained health factors between 1.01 and 1.03, indicating low probability of full repayment.
… Continue reading the full article at the original source below.
