2026-04-21
Kelp DAO Hack
- He breaks down the 292 million dollar KelpDAO hack, the year's largest DeFi exploit, using an AI-generated website that walks through the root cause analyses.
- The exploit was a cross-chain message forgery, not a smart contract bug, made possible by KelpDAO using a single one-of-one LayerZero verifier configuration.
- The real damage came from contagion: stolen restaked Ether was posted as collateral in lending markets, creating bad debt and a 13 billion dollar TVL bank run.
- Evidence points to North Korea's Lazarus Group, which he says uses mythic-class frontier models to find emergent vulnerabilities humans miss.
- He argues Midnight's zero knowledge proofs, MPC, and trusted execution environments are built precisely to make DeFi and bridges this much safer.
31 entries
From his Wyoming clinic, he addresses the major KelpDAO hack in the Ethereum restaked Ether ecosystem after waiting for enough root cause analyses to form.
He used AI to turn the internal incident report into a website to walk through what happened, showing the cloud-generated page.
292 million was stolen on April 18, about 116,500 restaked Ether from KelpDAO's escrow, the year's largest DeFi exploit against a 1.5 to 2 billion TVL.
Unlike Cardano's liquid non-custodial staking, Ethereum locks staked Ether, so Lido was created to turn it into liquid stETH.
Restaking chases extra yield, and Sreeram's Minotaur paper with IO became EigenLayer, with KelpDAO a restaking protocol stacked on Lido.
Each wrapper layer adds risk to the one-to-one backing, and cross-chain bridges use a three-phase lock, mint, and burn process between source and destination chains.
The hard problem is verifying a source-chain event on the destination chain, and nearly all nine and ten figure bridge hacks break this verification step.
LayerZero's omnichain fungible token uses DVN verifiers to confirm messages and preserve supply, which is why it invests in Jolt to send proofs like Midnight's Nightstream.
Best practice is a trust threshold of multiple DVNs like two of three, but Kelp used a one-of-one default configuration with a single verifier.
Lending protocols like Aave, Compound, and Euler let you deposit collateral and borrow a different token, the core of Bitcoin DeFi.
An attacker can deposit stolen restaked Ether, borrow liquid wrapped Ether against it, and walk away, leaving an unbacked poisoned asset in the lending protocol.
The exploit was a cross-chain message forgery, not a smart contract or accounting bug in Kelp or LayerZero, with three disagreeing parallel postmortems and CredShields unsure where the break sits.
Traces the attack from a Tornado Cash obfuscated origin through a spoofed inbound LayerZero packet claiming unichain endpoint 30320, with RPC poisoning and DDoS making the DVN accept it.
The one-of-one DVN responsibility is contested, and LayerZero will stop attesting such configs, which Kelp says roughly 40 percent of OApps use, with a Yearn core dev confirming single-source defaults.
The attacker was paused within 46 minutes but the tokens were already in lending markets, and the Llama Risk and Aave Labs report pegs 83,471 ETH across seven wallets.
The report models either a 123 million dollar socialized haircut or a 230 million dollar isolated loss across Mantle, Arbitrum, Base, and Ink.
The Aave DAO treasury is 181 million and Marc Zeller estimates a 5 to 8 percent haircut, with contagion hitting nine protocols including Spark, Fluid, Ethena, Pendle, and Lombard, dropping DeFi TVL over 13 billion.
Justin Sun pulled 65,000 Ether from Aave and publicly asked the attacker to negotiate, with restaked Ether depegging roughly 35 percent intraday.
The culprit appears to be North Korea's Lazarus Group, though no forensics firm like Chainalysis, Elliptic, or SlowMist has issued a definitive attribution.
The key lessons are not to trust a bridge unilaterally, that verification not application logic failed, a one-of-one verifier is unsafe, and incident response is vital.
Midnight was built for this, since a private DEX avoids Tornado Cash cesspits and MPC with TEEs makes turnkey multi-verifier DVN thresholds easy when LayerZero comes to Midnight.
A knowledge engine sending a small constant-time folded proof with each message prevents poison messages, and network anonymization makes the DDoS used here much harder.
Hacks will get much worse for everyone including Cardano because frontier models can scan code for flaws that arise not from bad code but from emergent combinations.
AI excels at detecting emergent bugs by holding a whole codebase in memory, so mitigations are formal methods, clean architecture, and modeling complex adaptive systems.
Midnight lives in the design space of zero knowledge proofs, MPC, and TEEs because safe DeFi needs a bespoke regulating layer over many chains, bridges, and asset representations.
Nightstream folds up a whole chain into real-time proofs of any system's state, so messages carry proofs and privacy hides where to DDoS or eclipse.
Determinism, liquid non-custodial staking, a DeFi kernel, and PoGan help, and Cardano's small DeFi market plus its architecture make these attacks much harder.
24/7 mass-liquidity systems enable multi-chain attacks that spread contagion in 46 minutes, so circuit breakers and freshness delays in lending protocols help.
Asks why 290 million dollar attacks keep happening, noting they are rare on Cardano and Bitcoin stayed out of the game, and calls for best-practice marketplaces via price or insurance.
The Lazarus Group uses mythic-class frontier models, having bribed Alibaba frontier lab members for access, so attacks will increase exponentially not decrease.
Recalls the 2016 DAO hack making international headlines, while the larger Kelp hack is shrugged off, with contagion and a 13 billion dollar bank run the novel crisis of confidence.