Zero Bugs Found: Halborn and the $292M Kelp DAO Hack

On Saturday, 18 April 2026, at 17:35 UTC, a cross-chain bridge operated by Kelp DAO released 116,500 rsETH to an attacker. The tokens were worth roughly $292 million, the largest DeFi hack of a year already crowded with them, and about 18 percent of all the rsETH in existence, according to CoinDesk. Kelp hit its emergency stop 46 minutes later. By then the money was already moving toward the laundering machinery that, in 2026, almost always ends in the same place. The detail worth sitting with is what did not happen: not one of Kelp’s audited smart contracts was broken, bypassed, or made to do anything its authors had not written.

That sentence is the story of crypto security in 2026, and it runs, in one form or another, through almost every post-mortem the blockchain security firm Halborn published this year. Kelp is the cleanest example, but it is not the only one. Five months later, on 6 September, Blockstream’s Liquid Network lost about $320 million in Bitcoin to a bug in its node software, per CoinDesk; the network’s 11-of-15 federation produced eleven perfectly valid signatures because, from where the signers sat, the withdrawal looked ordinary. Different chain, different bug, same lesson. The contracts, the signatures, the cryptography: all behaved exactly as designed. The loss came from somewhere the audit never looked.

Halborn has spent 2026 documenting that gap in a running series of forensic write-ups it calls, simply, Explained. What follows is a reconstruction of the one that defines the year, the Kelp DAO bridge exploit, built from Halborn’s account and those of the auditor whose code survived it, OpenZeppelin, the on-chain investigators at Chainalysis, and the two companies that spent three weeks blaming each other before one of them admitted fault. It is also an argument about what a security audit can and cannot buy, why the biggest losses of the year kept landing outside the code, and why, with no regulator anywhere requiring a smart-contract audit, the post-mortem has become the only court crypto has.

What a Halborn Post-Mortem Actually Is

Halborn is a blockchain security company founded in 2019 by Steven Walbroehl and Rob Behnke, bootstrapped for its first three years before raising a $90 million Series A led by Summit Partners in 2022. It audits smart contracts, but that is not what made its name. Halborn built its reputation on offensive work, red-team engagements that attack a client the way a real adversary would, and on incident response, the forensic reconstruction that happens after an attack succeeds. Since 2024 it has been run by chief executive Jacques Boschung, a former Kudelski Security executive, and has pushed toward banks and tokenized-asset issuers, but the technical core is the same offensive-first team it started with.

The Explained series sits at that forensic core. Each entry takes a specific hack, usually one Halborn did not audit and often one it had no commercial connection to, and rebuilds it from on-chain evidence and public disclosures: what the attacker did, in what order, why it worked, and what the defender could have done differently. It is the same genre a plane-crash investigator produces, and it serves the same function. Nobody can un-lose the money. The point is to make sure the next protocol does not lose it the same way. A crucial thing to understand up front is that in the Kelp case Halborn is the coroner, not the surgeon who signed off on the patient. The firm that audited Kelp’s contracts was OpenZeppelin, and its contracts held.

The $292 Million Question

To understand what was stolen, you have to understand what rsETH is. Kelp DAO runs a liquid restaking protocol: users deposit ether, Kelp restakes it through services such as EigenLayer to earn extra yield, and in return they hold rsETH, a token that represents their claim. Because rsETH is useful as collateral, holders want it on many chains at once, not just Ethereum. That is what the bridge was for. Kelp used LayerZero, a cross-chain messaging protocol, to let rsETH move between Ethereum and roughly twenty other networks. Lock or burn the token on one chain, and a message travels across LayerZero telling the other chain to release it.

Cross-chain bridges are the most dangerous real estate in crypto, for a simple structural reason: they hold enormous pooled balances, and they release those balances on the strength of a message from somewhere else. If you can forge the message, you do not need to break the vault. You just need to convince the vault that a valid withdrawal has been authorized. Every large bridge exploit of the past four years, from Ronin to Nomad to Wormhole, comes down to some version of that sentence. Kelp’s was no exception, and if you have read our earlier work on why the safest bridge is often no bridge at all, the shape of what follows will be familiar.

The 116,500 rsETH the attacker took represented about 18 percent of the token’s 630,000 circulating supply, per CoinDesk. That is not a rounding error in a large system; it is close to a fifth of the whole thing, extracted in a single afternoon. To pull it off, the attacker never went near the contract that held the funds. They went after the thing that told the contract what to do.

Reconstruction: How the Kelp Bridge Fell

LayerZero verifies cross-chain messages through what it calls a Decentralized Verifier Network, or DVN. In principle you can require several independent DVNs to agree before a message is accepted, the same way a multisig requires several keys. Kelp’s bridge, according to Chainalysis, was configured with a single verifier: a 1-of-1 DVN, where one node’s word was final. Kelp has said this was the default deployment configuration at the time. Whether it was truly the default or merely permitted became the central fight of the aftermath, but the effect is not in dispute. There was no second opinion. Forge the input to that one verifier, and the bridge would do whatever you told it.

So the attacker forged the input, and here Halborn’s reconstruction and Chainalysis’s forensics line up almost exactly. The verifier did not pull its data from thin air; it read from a set of RPC nodes, the servers that relay blockchain data. The attacker obtained Kelp’s internal node list, then compromised two internal RPC nodes running on separate clusters. Rather than crash them, which would have raised alarms, they swapped the nodes’ software so the machines fed forged data to the verifier while returning honest data to everything else. That selective lie is the craftsmanship of the whole operation.

The problem for the attacker was redundancy: Kelp ran other RPC nodes they could not reach, and those honest nodes would have contradicted the forged story. The solution was blunt. The attacker launched a distributed denial-of-service attack against an external RPC node, knocking it offline and forcing the verifier to fail over to the only nodes still answering, which were the two the attacker controlled. With the honest sources silenced, the poisoned nodes reported a phantom event: an rsETH burn on Unichain, one of the connected chains, that had never actually happened. The 1-of-1 DVN inspected the message, found it internally consistent, and authorized the bridge to release 116,500 rsETH against a burn that never occurred. When it was done, the malware on the compromised nodes deleted itself, erasing its binaries and local logs to slow anyone trying to reconstruct the path.

Zero Bugs Found

OpenZeppelin, which audited Kelp’s contracts, published its own post-mortem under a title that doubles as the thesis of the entire year: “$292 Million Lost, Zero Bugs Found.” Its verdict on the code was six words long: “The contracts performed exactly as written.” No reentrancy, no arithmetic overflow, no access-control slip, none of the classic failure modes an audit hunts for. The Solidity did its job. The system around it did not.

What makes the write-up valuable is that it does not hide behind that clean bill of health. Instead it spells out, in plain language, the things a smart-contract audit does not examine, and the Kelp attack walked through every one of them:

• how third-party protocol integrations are configured at deployment;
• whether infrastructure components such as RPC nodes, relayers, and oracle setups introduce a single point of failure;
• whether the default settings recommended by protocol documentation have actually been followed;
• how a system behaves when its off-chain dependencies are compromised.

Read that list against the reconstruction above and the hack becomes almost boring in its inevitability. The 1-of-1 verifier was a deployment configuration. The RPC nodes were infrastructure. The question of whether the single-DVN setup was a safe default was exactly the question no audit had been scoped to ask. And the entire attack was a demonstration of what happens when off-chain dependencies are compromised. OpenZeppelin’s framing is that code risk and operational risk are two different categories of security, and that a clean audit speaks only to the first. That distinction is the hinge the whole 2026 story turns on.

The Blame War and the Default That Was Not Safe

If the code was innocent, someone still had to answer for the configuration, and the three weeks after the hack turned into a public argument over who. Kelp’s position was that the 1-of-1 verifier was the default LayerZero deployment, the path of least resistance for a team wiring up a bridge. LayerZero’s first response, per CoinDesk, was to push back: the single-verifier setup was a choice, it said, made against guidance, and it attributed the operation to North Korea’s Lazarus Group. Victim and vendor spent the better part of a month trading statements while users who had lost real money watched.

Then LayerZero reversed. In a follow-up statement, reported by The Crypto Times, the company conceded that it had let its own verifier act as a 1-of-1 DVN for high-value transactions, that it had not policed what that verifier was securing, and that its documentation had effectively promoted the risky single-verifier pattern, which it acknowledged some 47 percent of applications were using. Its words: “We didn’t police what our DVN was securing, which created a risk we simply didn’t see. We own that.” It also admitted that its first post-mortem “did not fully reflect what mattered most to users who lost funds.”

The reversal matters beyond the optics. A configuration that 47 percent of applications share is not an exotic mistake by one careless team; it is a default that quietly moved risk onto everyone who accepted it. That is the uncomfortable center of the Kelp story. The audit was clean, the vendor’s tooling worked as documented, and the protocol followed a common pattern, and $292 million still left the building. When responsibility is spread that thin, it is easy for each party to be individually defensible and for the user to be collectively ruined.

Follow the Money: Lazarus, the Freeze, and the Contagion

Attribution landed where most of 2026’s large thefts land. LayerZero and later analysts pointed to the Lazarus Group, specifically the TraderTraitor sub-cluster, the same North Korean operation tied to the record $1.5 billion Bybit heist of 2025. The tell was not just the laundering pattern but the discipline of the intrusion: the months of preparation, the selective data poisoning, the self-deleting malware. This was not a teenager with a flash-loan script. It was a state program treating a bridge as a target of opportunity.

The response was faster than the attacker expected, and it did not come from a court. The attacker tried to run a second theft, roughly 40,000 rsETH worth about $95 million, and this time the defenders were ready. According to Chainalysis, the Arbitrum Security Council froze 30,766 ETH of downstream attacker funds within hours, cutting off the exit before the stolen rsETH could be fully converted. On the lending side the containment was just as quick: CoinDesk reported that Aave froze its rsETH markets on V3 and V4 within hours, and SparkLend and Fluid did the same, while the AAVE token fell about 10 percent as the market priced in the risk of bad debt. OpenZeppelin’s forensics put 89,567 of the stolen rsETH straight onto Aave as collateral, which is why the freeze was not a courtesy but a firebreak.

It is worth naming what that firebreak actually was. A committee of humans reached into a supposedly permissionless system and hit pause. It worked, and it saved users from a second drain, but it is exactly the kind of centralized emergency power that crypto spent a decade promising it did not need. That trade-off, speed of response against the censorship resistance the technology was sold on, is one the Liquid federation faced again in September when it halted its own chain, and it is not going away. The recoveries that work in 2026 tend to depend on somebody, somewhere, having a kill switch.

The Casebook: What Halborn Wrote Up in 2026

Kelp is the marquee entry, but it is one case in a thick 2026 file. Read Halborn’s Explained series in sequence and it stops looking like a set of unrelated accidents and starts looking like a single argument made over and over. The day before Kelp, on 1 April, Drift lost about $285 million on Solana to a months-long social-engineering operation that ended in a fraudulent pre-signing of the protocol’s Security Council, per Chainalysis; the second-largest Solana exploit on record, and again, no contract bug. In June, Halborn’s write-up of the Humanity Protocol hack traced a roughly $36 million loss to seven private keys sitting on a single malware-infected laptop. The same month, the Syscoin bridge lost about $10 million to a proof-validation error in its bridge infrastructure.

July was worse. The BonkDAO treasury was drained of about $20 million through a governance takeover on Solana’s Realms platform. Ostium, an Arbitrum-based perpetuals exchange, lost roughly $18 million to oracle manipulation, the kind of design-level flaw that sits in the blind spot between code and market we mapped in our guide to how on-chain perpetual futures actually work. And starting 30 July, Coldcard hardware-wallet users watched their bitcoin drain away because of a firmware build error from 2021 that had quietly weakened key generation for years; TRM Labs put the forensic tally at more than $116 million. In August, Halborn’s account of the Harmony hack described a consensus-level bug in how the chain handled block approvals that let an attacker inflate the token supply by more than a quarter, driving the price down about 40 percent.

The Pattern: Keys and Config Beat Code

Zoom out from the individual cases and the numbers say the same thing the anecdotes do. In its half-year review, TRM Labs counted 207 hacks in the first half of 2026, with about $972 million stolen, less than half the $2.3 billion of the same period a year earlier. But the interesting figure is the split. Smart-contract exploits made up 125 of those 207 incidents, a clear majority by count. Infrastructure and operational compromises were only about 15 percent of incidents, yet they accounted for roughly 76 percent of the money. Put plainly: audits catch the most common kind of attack and miss the most expensive kind. Kelp, Drift, and the Liquid federation all sit on the wrong side of that ratio.

The same asymmetry shows up in the annual data. Chainalysis tallied more than $3.4 billion stolen in 2025, of which North Korea-linked actors took about $2.02 billion, with the single Bybit heist accounting for roughly $1.5 billion. The center of gravity has moved from Solidity to sessions, keys, and configuration. Ronghui Gu, CertiK’s co-founder, put the shift as bluntly as anyone in a July interview with Forbes: “A protocol can pass a flawless code audit and still lose millions because of a compromised admin key.” In 2026 that reads less like an observation than a warning label.

What an Audit Actually Buys You

None of this means audits are worthless, and it is worth being precise about that, because “audited” has become a marketing badge whose meaning most users misread. Our recent look at who actually audits Solana and Move code found the same confusion in the non-EVM world. A smart-contract audit is a time-boxed manual review of a specific commit of code against a specific scope. Done well, by a serious firm, it is genuinely valuable: it catches the reentrancy bugs, the rounding errors, the broken access control, and the upgrade-pattern traps that have drained hundreds of protocols. What it is not is a certificate that the deployed system is safe.

Three limits do most of the damage. First, an audit is a snapshot: it reviews the code as it was on a given day, and protocols change, redeploy, and add integrations after the auditors leave. Second, it is scoped: the contract is in, but the RPC nodes, the key management, the bridge configuration, and the humans with admin access usually are not. Third, audit contracts almost universally disclaim financial liability, delivering findings on an as-is basis with damages capped at the fee paid, so the auditor is selling an opinion, not a guarantee. The table below, drawn from OpenZeppelin’s own account of what its Kelp review did and did not cover, is the clearest map of the gap.

Why No One Is Accountable

Here is the part that surprises people outside the industry. No regulator anywhere requires a smart-contract audit, and no regulator accredits smart-contract auditors. There is no Solidity equivalent of the accounting profession’s oversight board, no license to revoke, no standard of care a court can measure a firm against. In traditional finance a statutory auditor who signs off on fraudulent books carries real civil and sometimes criminal liability. In crypto, an auditing firm whose client is drained the month after a clean report faces, at most, a bad week on social media.

In the United States the Securities and Exchange Commission has spent the past year rewriting its posture toward digital assets, but not in this direction. In a November 2025 keynote laying out what the agency calls Project Crypto, chair Paul Atkins framed the SEC’s work around token classification and market structure, whether a given asset is a security and how it can be issued and traded, not around code-review standards or auditor accreditation. Europe’s MiCA regime and its operational-resilience companion DORA regulate the exchanges and custodians that touch crypto, but as we detailed in our account of what a MiCA license does and does not cover, neither mandates a Solidity audit, and fully decentralized protocols fall outside the perimeter entirely. Kelp has no CASP to complain to.

The consequence is that reputation is the only court in session, and it is a slow and forgiving one. The market punishes a bad post-mortem more reliably than it punishes a bad audit, which is part of why the post-mortem has become the security industry’s real product. When there is no regulator to hand down a verdict, the forensic write-up is the verdict, and firms like Halborn compete on the quality and honesty of theirs.

What Would Have Stopped It

The uncomfortable answer is that a better audit would not have. Everything that failed at Kelp sat outside the code, so the fixes have to live there too. The most direct one is the obvious one: never let a bridge that holds hundreds of millions of dollars rely on a single verifier. A multi-DVN setup requiring several independent verifiers to agree would have meant the attacker had to poison not one data path but several at once, a far higher bar. LayerZero now recommends exactly that, which is a polite way of saying the default should have been safer from the start.

Beyond configuration, the Kelp attack is a case study in why serious security in 2026 has to include the infrastructure and the people, not just the contracts. That is the discipline Halborn built its name on: red-team engagements that attack a client’s RPC nodes, cloud accounts, and staff the way Lazarus did, rather than only reading its Solidity. It is also why the firm now advertises services for infrastructure and even for the machine-learning systems that increasingly sit in the attack path. Steven Walbroehl, Halborn’s co-founder and chief technology officer, has warned that attackers already use artificial intelligence to build “highly personalized, context-aware attacks that bypass traditional security awareness training.” The RPC operators Kelp trusted, the laptop Humanity Protocol left keys on, the staff Drift’s attackers cultivated for months: those are the surface that matters now, and no contract audit looks at any of them. The endpoint has quietly become the vault, a shift our colleagues traced through Trail of Bits and its work on mobile and device security, and it is defended with entirely different tools.

The rest is unglamorous operational hygiene: hardware-backed key management with no seven keys on one laptop; anomaly monitoring that flags a bridge releasing a fifth of its supply in one transaction; redundancy that cannot be collapsed by knocking a single node offline; and the assumption, baked into every design decision, that any single component can be turned against you. None of it is exotic. All of it is the part teams skip when the audit came back clean and the launch date is close.

The Coroner’s Limits

A post-mortem cannot return the money. The Kelp attacker was a state actor with no interest in a bounty, so there was no negotiation to be had, only a freeze that saved the second tranche and a laundering trail for investigators to follow. What a good post-mortem does instead is convert one protocol’s catastrophe into an industry-wide lesson, fast enough that the next team can act on it. Halborn’s Explained series, OpenZeppelin’s unusually candid “zero bugs found” accounting, and Chainalysis’s on-chain reconstruction together turned Kelp from a $292 million mystery into a documented, teachable failure within weeks.

The quality of these documents varies, and learning to read them is a skill in itself. The good ones name the root cause without euphemism, publish a timeline, quantify the loss honestly, and say plainly what will change. The bad ones bury the failure in passive voice, blame an unnamed sophisticated attacker, and promise vague improvements. The single most useful signal is whether the write-up admits something the author would rather not: LayerZero’s eventual “We own that” is worth more than a hundred statements that a matter remains under investigation. In an industry with no regulator to compel disclosure, that voluntary candor is the closest thing to accountability on offer.

What It Means for 2026 and Beyond

For anyone who deposits into a DeFi protocol, the practical takeaway from the Kelp reconstruction is a mental correction. The word “audited” tells you the code was reviewed on some past date against some scope. It tells you nothing about how the bridge is configured, who holds the admin keys, whether the RPC infrastructure has a single point of failure, or how the team would react at 3 a.m. on a Saturday. Those are the questions that decided who kept their money in 2026, and they are not the questions an audit answers.

For protocols, the lesson Halborn keeps writing down is that a clean audit is table stakes, not a finish line. The money in 2026 leaves through the verifier, the node, the key, and the human, and defending those requires red-teaming, infrastructure hardening, monitoring, and rehearsed incident response, a wider and more expensive program than a single review of the contracts. The firms that internalize that will still get hit, because everyone does; they will simply lose less, contain faster, and write a post-mortem the rest of the industry can learn from. The ones that keep pointing at a clean audit report as proof of safety are, as Kelp showed, one forged message away from being the next case in the file.

Frequently Asked Questions

What was the Kelp DAO hack?

On 18 April 2026, an attacker drained about $292 million (116,500 rsETH) from Kelp DAO’s cross-chain bridge, the largest DeFi hack of the year. The attacker did not break Kelp’s smart contracts; they compromised the off-chain infrastructure that fed the bridge’s single verifier, forging a message that authorized the release of funds against a token burn that never happened.

If Kelp was audited, how did it get hacked?

Kelp’s contracts were audited by OpenZeppelin and, in the auditor’s own words, “performed exactly as written.” The failure was in configuration and infrastructure, a 1-of-1 verifier and compromised RPC nodes, which a smart-contract audit does not examine. An audit reviews code at a fixed point in time and scope; it is not a guarantee that the deployed system, its keys, or its integrations are safe.

Who is Halborn and what is its Explained series?

Halborn is a blockchain security firm founded in 2019, known for offensive security and incident response. Its Explained series is a set of forensic post-mortems that reconstruct specific hacks from on-chain evidence and public disclosures, documenting what the attacker did and why it worked so other protocols can avoid the same fate.

Who was behind the Kelp DAO hack?

The operation was attributed to North Korea’s Lazarus Group, specifically the TraderTraitor sub-cluster, the same actor tied to the $1.5 billion Bybit heist of 2025. The months of preparation, selective data poisoning, and self-deleting malware were consistent with a state-backed program rather than an opportunistic attacker.

Does any regulator require crypto audits?

No. No regulator anywhere mandates a smart-contract audit or accredits smart-contract auditors. In the United States the SEC under chair Paul Atkins has focused on token classification and market structure rather than code standards, and Europe’s MiCA and DORA regulate exchanges and custodians, not protocol code. Reputation, expressed largely through post-mortems, is the only real check.

Anneke de Vries is HOGE Wire’s security desk editor.