KelpDAO lost 116,500 rsETH — approximately $292 million — on April 18, 2026 after Lazarus Group (DPRK TraderTraitor) compromised two RPC nodes powering LayerZero's 1-of-1 verifier bridge. Malicious node software accepted a forged cross-chain message and drained the funds across 20 chains. An emergency pause 46 minutes later blocked a follow-up attempt targeting an additional $200 million. Post-mortem: https://rekt.news/kelpdao-rekt