$290M Kelp DAO Hack Explained: How North Korea’s Lazarus Group Exploited Web3 Infrastructure
$290M Kelp DAO Hack Explained: How Lazarus Exploited Web3 Infrastructure (2026)
The crypto industry has witnessed one of the most sophisticated attacks of 2026.
A hacking group linked to North Korea—Lazarus Group—stole nearly $290 million from Kelp DAO by exploiting weaknesses in cross-chain infrastructure.
This was not a typical hack. It exposed a deeper issue in Web3 systems.
---What Happened in the Kelp DAO Hack?
The attack occurred around April 18, 2026, when hackers drained approximately 116,500 rsETH tokens, worth about $290 million.
This became the largest DeFi exploit of 2026. 1
The stolen funds represented nearly 18% of the token’s supply. 2
---How the Hack Actually Worked (Step-by-Step)
3This attack did not exploit a smart contract bug.
Instead, it targeted off-chain infrastructure—a much more dangerous layer.
Step-by-step breakdown:
- Attackers compromised RPC (Remote Procedure Call) nodes
- Injected fake transaction data
- Launched DDoS attacks on legitimate nodes
- Forced system to trust compromised nodes
- Generated fraudulent cross-chain messages
- Funds were released based on fake verification
Even on-chain transactions looked completely valid. 4
---The Core Vulnerability: Single Verification Failure
The biggest weakness was a 1-of-1 DVN (verification system).
This means:
- Only one validator was needed
- No backup verification existed
Once that validator was compromised, the entire system failed. 5
---LayerZero’s Role in the Exploit
6Kelp DAO relied on LayerZero for cross-chain communication.
LayerZero allows blockchains to exchange data securely.
However, attackers exploited the verification layer—not the blockchain itself.
This distinction is critical.
---Why This Hack Is More Dangerous Than Others
Most crypto hacks involve:
- Smart contract bugs
- Private key leaks
This hack targeted something deeper:
- Infrastructure manipulation
- Verification systems
- Network-level trust
It proves that even “secure” systems can be bypassed.
---Who Is Lazarus Group?
Lazarus is a state-sponsored hacking group linked to North Korea.
They are responsible for multiple crypto thefts worth billions.
This hack adds to their long history of targeting Web3 systems.
---Impact on the Crypto Market
7The hack triggered:
- Protocol shutdowns
- Liquidity withdrawals
- Market panic
DeFi platforms saw billions in liquidity shifts after the attack.
---Could This Hack Have Been Prevented?
Yes.
Experts suggest:
- Using multi-validator systems
- Avoiding single points of failure
- Improving monitoring systems
This was not an unavoidable attack—it was a design flaw.
---What This Means for Web3 Security
This hack proves:
Web3 is only as strong as its weakest layer.
Even if smart contracts are secure, infrastructure vulnerabilities can destroy systems.
---Final Verdict
The Kelp DAO hack is a turning point in crypto security.
It shifts focus from:
- Code security → Infrastructure security
Conclusion
This was not just a hack—it was a warning.
As crypto evolves, attacks will become more complex.
Understanding these risks is essential for survival in Web3.
Comments
Post a Comment