Kelp DAO rsETH Exploit: What Actually Happened

Summary

• A normal-looking LayerZero packet (nonce 308) was verified, committed, and executed on Ethereum, releasing 116,500 rsETH from bridge inventory without any burn or nonce advance on Unichain.
• This was a phantom cross-chain message, not a mint exploit or reentrancy.
• The Unichain-Ethereum route used a longstanding 1-of-1 DVN setup with LayerZero’s own labeled verifier as the single point of failure.
• Nonce mismatch confirms no source-side event occurred – only this route showed the anomaly.
• Kelp quickly froze the recipient, blocking a second packet and saving ~$100M – mainnet rsETH remains fully backed.