OAK — OnChain Attack Knowledge

Worked example · 2026-04

KelpDAO rsETH — nobody stole a signing key; the verifier signed honestly over a chain it was being lied to about — KelpDAO rsETH / LayerZero OFT / Unichain → Ethereum — 2026-04-18

Loss
116,500 rsETH, ~$292M, released from the Ethereum-side contract against a burn on Unichain that never happened. A follow-up attempt targeting a further ~$95M did not succeed. The damage did not stop at Kelp: the attacker deposited unbacked rsETH into Aave V3 as collateral and borrowed against it, leaving Aave facing up to ~$230.1M in bad debt on the worst-case scenario (~$124M if the shortfall were spread across all rsETH holders as a ~15% depeg; ~$230M if isolated to L2s, concentrated on Arbitrum and Mantle). By 19:00 UTC on 2026-04-18 all rsETH and wrsETH reserves across Aave V3 deployments were frozen, LTV set to zero, and interest-rate models adjusted. A cross-protocol coalition — "DeFi United", with Aave, Lido, Ether.fi, Ethena, Mantle and the Aave DAO — raised ~$160M of the ~$200M required. KelpDAO subsequently migrated rsETH to Chainlink CCIP.
OAK Techniques observed
OAK-T10.002.001 (Off-chain Observer Source-Event Forgery — primary, confirmed by LayerZero Labs' own incident report and by independent forensic analysis. The LayerZero Labs DVN — the off-chain verifier whose attestation released the funds — parsed correctly, reasoned correctly and signed honestly. What it read was false: the RPC nodes supplying its view of the source chain had been poisoned, and reported a burn event on Unichain that never occurred. See techniques/T10.002.001-off-chain-observer-source-event-forgery.md). OAK-T15.001 (Social Engineering of Operator Personnel — the entry vector on 2026-03-06: a LayerZero Labs developer was socially engineered, six weeks before the funds moved). OAK-T15.004 (Operator Credential Compromise — session keys harvested from that developer, used to pivot into LayerZero's RPC cloud environment). OAK-T14.003 (Restaking Cascading Risk — the Aave leg, with the mechanism corrected below: the cascade was driven by the attacker depositing unbacked rsETH as collateral, not only by existing positions falling underwater).
Attribution
confirmed — DPRK threat actor TraderTraitor, also tracked as UNC4899 (OAK-G01), attributed independently by Mandiant, CrowdStrike and zeroShadow, and named as such in LayerZero Labs' own published incident report.
Key teaching point
A verifier is only as truthful as its view of the chain, and almost nobody treats "where does my verifier get its data?" as part of the trust model. Every control in this bridge's design pointed at the signature: who holds the key, how it is stored, how many must agree. The attacker never went near it. They went one layer below — to the RPC nodes the verifier queries — and changed what reality looked like from where the verifier was standing. Three details make the operation worth studying as a template rather than a one-off. First, the poisoned nodes were memory-patched to keep telling the truth to LayerZero's own monitoring while lying to the DVN, so the deception was targeted at exactly one consumer and internal dashboards stayed green. Second, the attacker DoS'd an external RPC provider to force DVN signing onto the two nodes they controlled — the redundancy that existed was removed on demand, which means redundancy you do not verify under adversarial conditions is not redundancy. Third, none of it would have paid out under a multi-DVN configuration: rsETH ran a single verifier, and that single choice is what separated a contained intrusion from $292M. The controls follow directly: quorum across independently operated verifiers, source diversity and integrity attestation for RPC data, custody reconciliation before release (a burn with no matching custody change is detectable at payment one), and treating the data path into a verifier as in-scope for the same review tier as the key path.

Explicitly not OAK-T10.001 (Validator / Signer-Key Compromise). No cryptographic or signing key was stolen. This is the load-bearing correction in this file, and it inverts the mitigation: the DVN's signature over the fraudulent message was cryptographically valid and produced by the legitimate key, because the key was never the target. Key hygiene, HSMs, signer rotation and threshold-signature hardening would each have left this attack completely unaffected. See Discussion for the correction record.

Summary

KelpDAO issues rsETH, a liquid restaking token, and deployed it across chains using LayerZero's OFT standard. Cross-chain transfers are authorised by a DVN (Decentralized Verifier Network) — an off-chain verifier that observes the source chain and attests that the source-side event happened, on the strength of which the destination-side contract acts.

rsETH's OApp was configured with a single verifier: the LayerZero Labs DVN. No second DVN had to agree before funds moved.

The intrusion began on 2026-03-06, six weeks before anything was stolen. An attacker socially engineered a LayerZero Labs developer, harvested session keys, and used them to pivot into LayerZero's RPC cloud environment. There they obtained the list of RPC endpoints the DVN was querying, gained access to two independent internal nodes running on separate clusters, and replaced the software on them — patching node memory so that LayerZero's own tooling continued to receive correct responses, while the responses served to the DVN were manipulated.

To close the last gap, the attacker ran a denial-of-service attack against an external RPC provider, so that DVN signing could draw only on the two internal nodes they had already compromised.

On 2026-04-18, the poisoned nodes reported a burn of rsETH on Unichain. It had not happened. The DVN — reading only the nodes it could reach, all of which agreed — produced a valid attestation for the message. The Ethereum-side contract honoured it and released 116,500 rsETH, about $292M. A follow-up attempt against a further ~$95M failed.

The attacker then supplied the unbacked rsETH to Aave V3 as collateral and borrowed against it, converting a Kelp loss into a system-wide one. Aave froze all rsETH and wrsETH reserves by 19:00 UTC the same day, set LTV to zero and adjusted interest-rate models, facing up to ~$230.1M in bad debt. The DeFi United coalition raised ~$160M toward it.

Mandiant, CrowdStrike and zeroShadow attributed the operation to DPRK's TraderTraitor / UNC4899. LayerZero Labs published a detailed incident report, made multiple DVN attestors a baseline requirement, and rebuilt the compromised cloud infrastructure with hardened baselines and just-in-time privilege elevation. KelpDAO moved rsETH to Chainlink CCIP.

Timeline (UTC)

When Event OAK ref
(standing) rsETH deployed as a LayerZero OFT; the OApp is configured with a single verifier (1-of-1 DVN) (latent single point of failure)
2026-03-06 LayerZero Labs developer socially engineered; session keys harvested T15.001 → T15.004
2026-03-06 onward Pivot into LayerZero's RPC cloud environment; the RPC list the DVN queries is enumerated (pre-positioning)
before 04-18 Two independent internal RPC nodes on separate clusters compromised; memory patched so monitoring sees truth and the DVN sees tampered data T10.002.001 — source forgery, infrastructure level
before 04-18 DoS against an external RPC provider forces DVN signing onto the two poisoned internal nodes (redundancy removed on demand)
2026-04-18 Poisoned nodes report a burn on Unichain that never occurred; DVN issues a cryptographically valid attestation; Ethereum contract releases 116,500 rsETH (~$292M) T10.002.001 exploitation
2026-04-18 Follow-up attempt against a further ~$95M fails (contained)
2026-04-18 Attacker deposits unbacked rsETH into Aave V3 and borrows against it T14.003 — cascade initiation
2026-04-18, ~19:00 Aave freezes all rsETH / wrsETH reserves across V3, LTV → 0, interest-rate models adjusted (containment)
2026-04-20 Aave service providers / Llamarisk publish incident reports across Ethereum and Arbitrum markets; exposure scenarios put at ~$124M–$230.1M (impact assessment)
2026-04-23 → 04-26 DeFi United coalition forms (Aave, Lido, Ether.fi, Ethena, Mantle, Aave DAO); ~$160M of ~$200M raised (cross-protocol response)
2026-05-20 LayerZero Labs incident report published: session-key entry, RPC poisoning, DoS, single-verifier configuration; no keys stolen; attribution to TraderTraitor / UNC4899 (forensic disclosure)
after LayerZero enforces multiple DVN attestors as baseline, rebuilds cloud infrastructure with just-in-time privilege elevation; KelpDAO migrates rsETH to Chainlink CCIP (remediation)

What defenders observed

  • The gap between intrusion and theft was six weeks, and every day of it was inside someone else's infrastructure. Initial access on 2026-03-06, funds on 2026-04-18. This is not a smash-and-grab against a contract; it is a patient infrastructure operation with a bridge as the payout, which is the DPRK bridge-targeting pattern the corpus records elsewhere. The detection opportunity was not on 04-18 — it was in the six weeks of anomalous access to an RPC cloud environment.
  • Selective lying is what defeated monitoring, and it should be assumed by default now. The nodes returned correct data to LayerZero's own tools and false data to the DVN. Any assurance derived from "our dashboards looked normal" is worthless against an attacker who can choose per-consumer responses. Verification must be performed by the consumer that acts on the data, not by a sibling system reading the same nodes.
  • The attacker removed the redundancy rather than defeating it. There was an external RPC provider. It was DoS'd. Redundancy that can be reduced by an attacker at the moment of use is a liveness feature, not a security control — and the correct test is whether the system fails closed when its sources shrink to a subset. Here, shrinking the source set to two agreeing nodes was treated as consensus.
  • Single-verifier configuration is the whole difference between contained and catastrophic. LayerZero's report is explicit that the blast radius was bounded to rsETH as a direct consequence of the OApp's single-DVN setup, with no contagion to other assets or applications. The same intrusion against a 2-of-3 configuration produces a failed attestation and an alert, not a payout. The choice was made at configuration time, by an integrator, long before any attacker existed.
  • A custody reconciliation catches this at payment one, as it does for every other anchor in this class. Release 116,500 rsETH only if the locked/issued invariant moved by 116,500. The invariant broke on the first release and nothing was reading it.
  • The contagion path ran through the attacker's own deposit, not through price alone. The attacker took the unbacked rsETH into Aave V3 as collateral and borrowed. That converts a bridge failure into a lending-market failure immediately and deliberately, without waiting for a depeg to propagate. Listing an asset whose supply integrity depends on a third party's off-chain verifier means inheriting that verifier's failure modes onto your own balance sheet — which is the argument for supply-attested collateral (proof of backing) rather than price-attested collateral.

Root-cause evidence

Public references

Discussion

Correction record (2026-09-16)

This file previously classified the incident as OAK-T10.001 (Validator / Signer-Key Compromise), described the mechanism as "a compromise of LayerZero's messaging infrastructure, which functionally serves as the signer," and recorded the attribution as pseudonymous. All three were wrong, and are corrected above. Per CORRECTIONS.md, the superseded claim is recorded here rather than silently removed.

The provenance is worth stating plainly, because it is a repeat of a known failure mode in this corpus. The original text was written in the v0.1 bulk release (commit f32645a), while the LayerZero investigation was still open — the file said so itself, listing "key-theft, insider action, or protocol-level vulnerability" as open possibilities and inviting a future update. Its Public references section contained no URLs at all, only generic descriptions of documents that would presumably exist ("Kelp DAO official incident announcement and post-mortem", "On-chain forensic analysis of the forged bridge message"). The facts landed publicly in May 2026 — LayerZero's two-part incident report, Chainalysis's and Blockaid's analyses — and the file was never revisited. A sourceless placeholder aged into a cited classification, which is precisely the pattern the 2026-07 fixture-provenance sweep was run to catch, here occurring in a release file rather than a fixture.

Four specific facts were corrected against the sources now cited:

  1. No signing key was compromised. The DVN's attestation was valid and produced by the legitimate key. T10.001 is therefore excluded, not merely de-prioritised.
  2. The attribution is confirmed, not pseudonymous. TraderTraitor / UNC4899, per Mandiant, CrowdStrike and zeroShadow, named in LayerZero's own report. The corpus's largest 2026 bridge incident was sitting unlinked to OAK-G01.
  3. The source chain was Unichain, not Arbitrum as the previous text implied in its bridging example.
  4. The Aave cascade mechanism was wrong. The previous text described pre-existing rsETH-collateralised loans falling underwater. What actually happened is that the attacker deposited the unbacked rsETH into Aave V3 and borrowed against it — an active step, not a passive repricing. Several unsourced figures from the prior version (a flat "~$200M in rsETH-collateralised loans outstanding", named DEX venues, a treasury-capacity claim) have been replaced with sourced ones or dropped.

Why the class matters more than the correction

With the mapping fixed, this becomes the largest anchor for OAK-T10.002.001 by two orders of magnitude, and it establishes a third sub-shape alongside parse-level (Across) and semantic (Coreum, Chainflip): (c) infrastructure-level source forgery, in which the observer's data source is subverted so that it parses correctly and reasons correctly over events that never occurred. The distinction is operationally sharp. Against (a) the fix is a type check on the parsed record; against (b) it is a custody reconciliation; against (c) neither the parser nor the message is defective — the fix is source diversity with integrity attestation, quorum across independently operated observers, and fail-closed behaviour when the source set shrinks.

The sub-shape has a second anchor at the opposite end of the loss scale: Long (2026-09-14, 46.7928 WETH / ~$118K), where a third-party RPC fed a custodial bridge's keeper fabricated withdrawal events and the keeper released from its Robinhood Chain vault. Same shape, one four-hundredth the size, no state actor, no six-week operation — which is the useful part. The technique does not require DPRK-grade capability; at the small end it requires only that a keeper trust one RPC provider.

The corpus-level reading is the uncomfortable one. OAK carried this incident for five months under a mapping that pointed defenders at key management — the one control surface that was never in play. A framework's cost of a wrong mapping is not the wrong label; it is every reader who checked their HSM policy and considered the lesson applied.

Techniques demonstrated (4)