On April 18, 2026, Kelp DAO's rsETH token was exploited through a LayerZero V2 bridge vulnerability. A single compromised attestation point made a $292M malicious funds release look legitimate to the protocol. Within hours, Aave, SparkLend, Compound, and Fluid had paused rsETH markets. Lido and Upshift froze deposits.
KPK — an institutional onchain asset manager running capital across six DAO treasuries and curated Morpho vaults — had 20 minutes to decide whether their entire portfolio was at risk. Their post-mortem, published June 10, offers a rare inside account of what institutional incident response actually looks like during a live DeFi crisis.
The Timeline
The Five Systems That Mattered
1. Pre-Deployed Permissions Layer
KPK's non-custodial smart-contract framework defines exactly what the asset manager can and cannot do — without ever taking custody of client funds. During the crisis, no new approvals or keys were needed. The permissions were already in place from mandate deployment. The team could move funds in seconds, but only inside pre-drawn lines.
2. Automated Agents + Human Escalation
KPK runs automated agents that continuously manage allocations across approved markets — maintaining withdrawal liquidity, monitoring risk parameters, executing rebalances. When a high-confidence risk alert fires on a preconfigured incident trigger, exit agents pull liquidity before a human is even in the loop. But the rsETH vector was novel, requiring manual escalation within 13 minutes of activation. The architecture compresses the vulnerability window without eliminating human judgment.
3. Parallel Blast-Radius Mapping
Six DAOs (ENS, CoW DAO, Arbitrum, Balancer, Nexus Mutual, dYdX), each with independent mandates and risk parameters. KPK ran a cross-reference matrix in parallel: direct exposure, indirect lending-protocol contagion, shared oracles, shared bridge infrastructure, liquidation health under stress. Tailored impact summaries were published to each DAO's governance channel. All logged and timestamped.
4. Three-Stage Communication Protocol
Stage one: acknowledge immediately. Aware and responding. No detail, no speculation. Stage two: update with actions taken — deposits halted, positions exited, scope confirmed. Stage three: resolve with full account of what happened and what changed. Each stage requires legal sign-off. It prevents premature disclosure that creates panic or legal exposure, and it handles the challenge of communicating with multiple audiences simultaneously: DAO committees, public vault depositors, and the wider market.
5. Drills That Build Muscle Memory
KPK runs quarterly company-wide drills plus monthly curation drills with extra reps on high-probability scenarios. Attack classes include multisig compromises, flash loan exploits, oracle failures, liquidation cascades, and stablecoin depegs. In March 2026 — one month before the real incident — the team ran a drill simulating a RedStone oracle malfunction. They built actual transaction payloads to hot-swap affected oracles in production. Those payloads are now wired into the threat-detection platform for fully automated emergency response.
What Shipped After: 97 New Monitors
| Area | Change |
|---|---|
| Detection | 97 new monitors covering oracle attacks, governance attacks, and bridge exploits |
| Automation | Extended scope of conditions triggering automatic fund movements; upstream protocol deps wired into alerting |
| Signal intake | Automated X screening for trusted security accounts — not all emergencies give you 10 minutes |
| On-call | Formal PagerDuty rotation with phone-based escalation for after-hours |
| Depeg monitoring | Layered detection with secondary-source price comparison and per-asset historical thresholds |
| Speed | Forced rebalances on user withdrawals — alert to onchain execution in 17 seconds |
| Tooling | Internal Safe transaction scoping tool to prevent multisig attack vectors |
The Core Discipline
KPK runs post-mortems after every incident and after every false alarm. A dismissed threat that wasn't communicated fast enough reveals a process gap. A real alert that took too long to reach the right person reveals a detection gap. Both get fixed. Hot washes within hours capture the picture while memory is fresh. Full post-mortems within 48 hours produce structural changes.
Every incident closes with a list of changes that ship.
Actionable Steps for Web3 Teams
- Pre-deploy your permissions layer. Your emergency authority should exist before the emergency. If your team needs a multisig vote to start responding, you've already lost.
- Assign six war room roles today. On-call lead, analysts, strategy, engineering, comms, legal. Write names into each role. Rotate quarterly.
- Run drills that produce transaction payloads. Quarterly company-wide, monthly for risk. Simulate real attack classes and build executable exits — not table reads.
- Audit your key personnel, not just your code. Every team member with key access should be independently opsec-audited for phishing resistance, key storage, and comms hygiene.
- Dual-layer detection. Automated onchain monitoring for deterministic triggers + human signal channels (X, Telegram, partner protocols) for novel vectors.
- Adopt three-stage comms with legal gates. Acknowledge within minutes. Update within hours. Resolve within 48 hours. Silence is read as weakness.
- Template your blast-radius matrix now. Build it before you need it: direct exposure, contagion risk, shared oracles, shared bridge infra, shared collateral types.
- Measure and compress your alert-to-execution pipeline. KPK ships forced rebalances in 17 seconds. Know your number.
Source: KPK — Inside the War Room: How KPK Responds (June 10, 2026).