6 articles
Evercrest Technologies filed in the Supreme Court of British Columbia, alleging LayerZero approved its single-verifier bridge configuration in writing and warned another integrator about the same risk without warning Kelp. The claim adds a defamation count over LayerZero's post-exploit statements and seeks Evercrest's own losses rather than the full $292 million.
A hijacked LayerZero delegate on Base and BSC turned an approveAndCall into a mint function. Actual extraction came to about $675,000, but Upbit and Bithumb still halted SAND deposits.
WETH borrowing parameters on Aave V3 returned to pre-incident values across Ethereum Core, Ethereum Prime, Arbitrum, Base, Mantle and Linea on Monday, after more than 95 per cent of the unbacked rsETH from April's exploit was clawed back through liquidations.
Aave on Tuesday published the technical proposal that will determine whether DeFi can claw back the $292 million Kelp DAO lost to North Korean hackers ten days ago. The two-part plan re-collateralises rsETH with fresh ETH and uses a temporary oracle adjustment to liquidate seven attacker positions stranded across Aave and Compound.
LayerZero's post-mortem pins the largest DeFi exploit of 2026 on KelpDAO's single-verifier bridge configuration, but Kelp says it was using LayerZero's own defaults. North Korea's Lazarus Group has been attributed as the attacker.
An attacker drained 116,500 rsETH from Kelp's LayerZero-powered bridge on Saturday, triggering a withdrawal stampede at Aave that wiped a quarter of the lending giant's deposits in under 24 hours.
