A forged LayerZero message authenticated by KelpDAO's sole configured DVN caused its Ethereum OFTAdapter to release 116,500 rsETH, worth about $292 million, on April 18, 2026. The token, adapter, and LayerZero on-chain contracts operated as designed; the critical weakness was a 1-of-1 verifier configuration with no independent attestation. The attacker used the stolen rsETH as Aave collateral to borrow WETH, creating downstream bad-debt and liquidity concerns, while an emergency pause blocked a second attempted withdrawal of 40,000 rsETH. Blockaid had not confirmed how the DVN was compromised when the article was published.