Cross-chain DeFi faces fallout from $292M exploit

TLDR

A $292 million exploit of KelpDAOs rsETH bridge using LayerZero infrastructure has triggered a broad rethink of cross-chain DeFi security.

1. Attackers linked to North Koreas Lazarus Group poisoned LayerZeros internal RPCs and abused a 1-of-1 verifier setup to drain about $292 million in rsETH from KelpDAOs bridge.
2. The fallout includes major protocols migrating nearly $1 billion in assets to Chainlink CCIP, Aave bad debt and a complex legal recovery process for frozen ETH.
3. Cross-chain projects are now shifting toward multi-verifier, rate-limited bridge designs, and users should scrutinize default security, not just yields or speed.

Deep Dive

1. How The $292M Exploit Happened

On 18 April 2026, attackers exploited KelpDAOs rsETH cross-chain bridge, which used LayerZero, to drain roughly $292 million in rsETH.

LayerZero now says its internal RPC nodes, which feed data to its Decentralized Verifier Network (DVN), were compromised by North Koreas Lazarus Group while external RPC providers were hit with a DDoS, pushing the DVN onto poisoned data that signed fake transfers as if they were real.LayerZero admitted it made a mistake in allowing its DVN to operate in a 1-of-1 configuration for high value assets, creating a single point of failure.

After weeks of blaming KelpDAOs configuration, LayerZero issued a public apology and said it will no longer support 1/1 DVN setups and is migrating defaults to at least 3/3, ideally 5/5 verifiers.One post-mortem also disclosed an earlier internal multisig policy breach and new controls.

2. Fallout Across DeFi Protocols

The exploit rippled through DeFi. Attackers used unbacked rsETH as collateral on Aave to borrow around $230 million in ETH, leaving Aave with substantial bad debt until community and partner efforts recapitalize the system.A detailed report notes Aaves position and ongoing recovery work.

The Arbitrum Security Council froze 30,765 ETH tied to the attack; a U.S. federal judge has now authorized transferring that roughly $71 million to an Aave-controlled wallet to restore rsETHs 1-to-1 backing.The ruling also protects maker/">DAO governance participants from liability.

Separately, a DeFi United recovery initiative has raised over $300 million, with LayerZero contributing 10,000 ETH, to help cover losses and bad debt.Coverage of the effort underscores how large protocols now coordinate post-mortems and bailouts.

3. Migration To Chainlink And New Security Norms

A key reaction has been a flight to quality in cross-chain infrastructure. Solv Protocol, Re and KelpDAO are moving nearly $1 billion in assets off LayerZero to Chainlinks Cross-Chain Interoperability Protocol (CCIP), citing redundant validation, circuit breakers and compliance-grade controls.One report describes Solv migrating about $700 million in tokenized bitcoin and Re selecting CCIP as its exclusive bridge.

LayerZero is trying to catch up by banning 1/1 DVN configurations, raising multisig thresholds and building tools like Console and a Rust-based DVN client to harden operations.Its own disclosure says only 0.14% of apps and 0.36% of TVL were directly affected, but reputational damage is much larger.

Conclusion

The KelpDAO rsETH exploit shows how a single weak cross-chain configuration, combined with compromised infrastructure, can trigger hundreds of millions in losses, lending market stress and legal complexity. The immediate response is a migration toward more conservative bridge designs and providers that prioritize default security over flexibility. For anyone using cross-chain DeFi, the edge now lies in understanding those security models and favoring systems with redundancy and clear emergency controls, even if they trade off some speed or convenience.