Kelp says rsETH was drained on April 18 through a forged cross-chain message after two LayerZero-hosted RPC nodes were compromised and a third RPC node was hit by a simultaneous DDoS attack. The statement frames the incident as an attack on LayerZero infrastructure rather than Kelp-operated systems. Kelp reports that it detected the anomaly, paused relevant contracts on Ethereum mainnet and L2s, blacklisted exploiter wallets, and engaged SEAL-911. Those actions reportedly mitigated a follow-on attempt using a falsely verified phantom packet to target an additional 40,000 rsETH, worth about $95 million.