Back to Markets
Crypto▼ Bearish

Lazarus Group Identified in $292M KelpDAO Cross-Chain Breach

Lazarus Group Identified in $292M KelpDAO Cross-Chain Breach
AONRELYNOW

LayerZero has attributed a $292 million exploit of KelpDAO to the Lazarus Group, exposing critical vulnerabilities in cross-chain infrastructure and triggering significant liquidity instability.

AlphaScala Research Snapshot
Live stock context for companies directly referenced in this story
Alpha Score
55
Moderate

Alpha Score of 55 reflects moderate overall profile with moderate momentum, moderate value, moderate quality. Based on 3 of 4 signals — score is capped at 90 until remaining data ingests.

Alpha Score
45
Weak

Alpha Score of 45 reflects weak overall profile with strong momentum, poor value, poor quality, weak sentiment.

Technology
Alpha Score
46
Weak

Alpha Score of 46 reflects weak overall profile with strong momentum, poor value, moderate quality, weak sentiment.

Technology
Alpha Score
53
Weak

Alpha Score of 53 reflects moderate overall profile with poor momentum, strong value, strong quality, moderate sentiment.

This panel uses AlphaScala-native stock data, separate from the source wire linked above.

LayerZero has officially attributed the recent $292 million exploit of the KelpDAO ecosystem to the Lazarus Group. The breach targeted cross-chain infrastructure, allowing the attackers to siphon a substantial volume of rsETH tokens. This incident represents a significant escalation in the targeting of liquid restaking protocols, which rely on complex cross-chain messaging to maintain asset parity across different network layers.

Mechanics of the Cross-Chain Vulnerability

The attack exploited specific weaknesses in the cross-chain communication protocols that facilitate the movement of assets between the Ethereum mainnet and secondary chains. By manipulating the verification process within the bridge infrastructure, the attackers were able to bypass security checks and initiate unauthorized withdrawals of rsETH. The scale of the theft highlights the inherent risks associated with the reliance on third-party cross-chain bridges for liquidity management. As DeFi Liquidity Drains Accelerate Following KelpDAO Exploit, the broader ecosystem is facing renewed scrutiny regarding the security of smart contract interactions that span multiple blockchain environments.

Impact on Liquidity and Asset Parity

The sudden removal of $292 million in assets has triggered immediate liquidity constraints for users attempting to exit positions or rebalance portfolios. The drain has forced a sharp deviation in the price of rsETH from its intended peg, as the market struggles to absorb the impact of the stolen tokens being moved through various mixers and decentralized exchanges. This liquidity crunch is compounded by the fact that many users utilize these tokens as collateral for further leverage within the DeFi ecosystem. The resulting cascade of liquidations could place additional pressure on the underlying assets that back the restaking protocol.

AlphaScala currently tracks Agilent Technologies, Inc. (A stock page) with an Alpha Score of 55/100, labeled as Moderate within the Healthcare sector. While this stock operates outside the immediate scope of digital asset infrastructure, the broader market volatility often influences investor sentiment across high-growth technology sectors.

Regulatory and Security Response

The attribution to the Lazarus Group brings a geopolitical dimension to the recovery efforts, as the group is known for utilizing stolen funds to bypass international financial sanctions. Law enforcement agencies and blockchain forensics firms are currently tracking the movement of the stolen rsETH across various decentralized exchanges and privacy-focused protocols. The next critical marker for the market will be the response from the affected liquidity providers and the potential implementation of emergency circuit breakers within the cross-chain bridge architecture. Stakeholders are now waiting for a formal update on the recovery of assets and any potential compensation mechanisms for the affected users. The ability of the protocol to restore its peg will serve as a primary indicator of its long-term viability following this breach.

How this story was producedLast reviewed Apr 20, 2026

AI-drafted from named sources and checked against AlphaScala publishing rules before release. Direct quotes must match source text, low-information tables are removed, and thinner or higher-risk stories can be held for manual review.

Editorial Policy·Report a correction·Risk Disclaimer