Ripple's Security-First Stand: How the $292M KelpDAO Exploit Froze RLUSD's DeFi Bridge Expansion

Ripple's CTO has become the first regulated stablecoin issuer to publicly cite DeFi bridge counterparty risk as grounds for pausing cross-chain expansion — a watershed moment for institutional risk governance in crypto.

Executive Summary

• KelpDAO's April 18, 2026 exploit drained $292 million (116,500 rsETH) via a 1-of-1 DVN misconfiguration on LayerZero — the largest DeFi hack of 2026 and the proximate trigger for Ripple's bridge reassessment.

• Ripple CTO Emeritus David Schwartz publicly disclosed that his evaluation of DeFi bridging systems for RLUSD exposed an industry-wide pattern: bridge providers routinely recommend disabling their own security safeguards for operational convenience.

• Strategic implication: RLUSD's pause on third-party DeFi bridging, while Wormhole NTT-based native L2 expansion advances on a separate regulatory track, signals a bifurcated future — regulated native issuance versus permissioned bridge composability.

• Risk caveat: The pause leaves RLUSD's DeFi growth potential constrained at a critical juncture; the $315 billion stablecoin market is undergoing rapid chain fragmentation, and bridge-averse issuers risk ceding DeFi liquidity to less cautious competitors.

• Outlook: If Ripple and LayerZero formalize a more secure DVN standard and NYDFS greenlights L2 expansion, RLUSD could re-enter DeFi bridging by Q4 2026 with significantly stronger counterparty controls — potentially becoming the institutional benchmark for bridge security.

Background & Market Context

The stablecoin sector entered 2026 as one of the fastest-growing corners of crypto finance, with total stablecoin supply reaching $315 billion in Q1 2026 — a milestone analysts had projected would not arrive until late 2027. Within this landscape, Ripple's RLUSD had established itself as one of the fastest-growing regulated stablecoins in history, reaching $1 billion in circulating supply in under 120 days from launch and achieving a market cap of approximately $1.4–1.6 billion by April 2026, representing over 1,278% year-to-date growth. Transfer volume climbed to $18.4 billion in Q1 2026, the highest quarterly level on record, with March alone contributing over 55% of total quarterly activity.

Yet the very market conditions driving RLUSD's growth — a fragmented multi-chain ecosystem hungry for liquidity — also placed regulated issuers like Ripple in a strategic bind. DeFi's composability model demands that stablecoins flow freely across chains via bridges, but those bridges have historically represented some of crypto's most catastrophic loss vectors. Since 2021, cross-chain bridge exploits have collectively cost the industry over $3 billion. The KelpDAO incident on April 18–19, 2026 raised the stakes dramatically, costing $292 million and triggering cascading failures across at least nine DeFi protocols — making it the single largest DeFi exploit of 2026 and one of the ten largest crypto hacks in history.

RLUSD occupies a uniquely exposed position in this environment because Ripple has staked its regulatory identity on compliance-first issuance. Unlike Tether (USDT), which operates largely outside U.S. regulatory oversight, or even Circle (USDC), which is incorporated under U.S. money-transmission frameworks but faces ongoing regulatory evolution, RLUSD operates under direct New York Department of Financial Services (NYDFS) supervision. Any bridge-related loss event would not merely be a financial setback — it would risk RLUSD's operating license and Ripple's hard-won regulatory credibility following its years-long legal battle with the U.S. Securities and Exchange Commission. This regulatory dimension elevates Ripple's bridge caution from a technical preference into an existential business constraint.

The macro backdrop amplifies the dilemma. With projections suggesting the stablecoin market could exceed $1 trillion by late 2026, the addressable market for multi-chain stablecoin liquidity is enormous. Ripple had announced plans to expand RLUSD to Ethereum L2 networks including Optimism, Base, Ink, and Unichain via Wormhole's Native Token Transfer (NTT) standard — a non-LayerZero approach that uses a burn-and-mint model rather than wrapped tokens. That expansion remains on a separate regulatory and technical track, pending NYDFS approval. But the KelpDAO exploit has injected a chilling effect on the entire bridging ecosystem, prompting Schwartz to go public with an unusually candid assessment of the industry's security culture.

Key Developments

April 18, 2026 — KelpDAO Bridge Exploit Begins At approximately 02:00 UTC on April 18, attackers — subsequently attributed by LayerZero to North Korea's Lazarus Group, specifically the TraderTraitor sub-group — initiated a sophisticated multi-vector assault on KelpDAO's LayerZero bridging infrastructure. The attack targeted off-chain infrastructure rather than on-chain smart contracts: attackers compromised two internal RPC nodes operated by LayerZero Labs and simultaneously executed a distributed denial-of-service (DDoS) attack against an external RPC provider. This forced KelpDAO's Decentralized Verifier Network (DVN) to depend entirely on the compromised nodes.

April 18–19, 2026 — $292 Million Drained Across 20 Chains The compromised nodes fed forged transaction data to LayerZero's DVN, falsely reporting token burns on the source chain (Unichain) that had never occurred. Because KelpDAO had configured its rsETH bridge with a 1-of-1 DVN setup — using only LayerZero Labs as the sole verifier with no secondary verification required — the system accepted these phantom burn proofs without challenge and released 116,500 rsETH on Ethereum, worth approximately $292 million at prevailing prices. A secondary attack attempt targeting an additional ~$95 million (40,000 rsETH) was blocked after the Arbitrum Security Council froze 30,766 ETH of the attacker's downstream funds. The exploit cascaded across more than 20 chains where rsETH was deployed.

April 19, 2026 — Cascade Failures Across DeFi The unbacked rsETH supply immediately broke the protocol's core accounting invariant: assets released on destination chains must equal assets burned or locked on source chains. As rsETH's peg deviated, nine DeFi protocols with rsETH exposure froze their markets. Aave froze rsETH markets on both V3 and V4 within hours, triggering a $10 billion withdrawal wave from the protocol — one of the largest single-day withdrawal events in Aave's history. SparkLend and Fluid also froze their rsETH markets. The cascade created approximately $177 million in bad debt on Aave alone, raising immediate questions about protocol solvency buffers and governance response timelines.

April 20, 2026 — David Schwartz Goes Public One day after the exploit, Ripple CTO Emeritus David Schwartz — who had been quietly evaluating DeFi bridging systems for RLUSD's planned multi-chain expansion — posted a detailed public assessment. Schwartz confirmed he had identified the identical security pattern during his review: bridge providers market advanced security features prominently but then almost immediately recommend against using them. His statement included a direct indictment of the industry's culture: "Their sales pitch was that they have the best security features but they're easy to use and scale, assuming you don't use the security features." He characterized KelpDAO's choice to use a 1-of-1 DVN as an operational convenience decision with catastrophic consequences, calling the broader attack "way more sophisticated than I expected and aimed at LayerZero infrastructure taking advantage of KelpDAO laziness."

Late April 2026 — LayerZero Response and Industry Reckoning LayerZero formally announced it would no longer countersign messages from applications configured with a 1/1 DVN setup, effectively requiring multi-verifier configurations going forward. LayerZero disclosed that it had previously communicated best practices around DVN diversification to KelpDAO, but that KelpDAO had chosen to maintain a 1/1 configuration regardless. This post-hoc disclosure sharpened regulatory and institutional scrutiny of bridge providers' responsibility to enforce their own security standards rather than offering them as optional upgrades. Ripple's implicit decision to pause RLUSD's DeFi bridge expansion became the clearest institutional signal that regulated issuers would not absorb this risk profile.

Technical Analysis

The KelpDAO exploit represents a fundamentally different class of bridge attack than most DeFi observers anticipated. Previous major bridge hacks — such as the Ronin Bridge exploit ($625M, 2022), the Wormhole hack ($320M, 2022), and the Nomad exploit ($190M, 2022) — targeted on-chain smart contract vulnerabilities: bugs in the bridge contract itself, flaws in token custody logic, or governance key compromises. The KelpDAO attack instead targeted the off-chain verification layer — the "oracle layer" that bridges use to confirm that events on one chain actually happened before minting tokens on another. This represents an evolution in attack sophistication that makes traditional smart contract auditing insufficient as a security guarantee.

LayerZero's protocol architecture allows application developers (OApp owners) to configure their own DVN setup — essentially choosing which third-party validators must attest to cross-chain messages before they are processed. This configurability is a deliberate design choice that gives protocols flexibility but creates a surface area for security misconfiguration. KelpDAO's rsETH bridge used only a single DVN (LayerZero Labs itself), meaning a single point of verification failure could authorize unlimited minting. The correct security posture — which LayerZero's documentation recommends — involves at least two independent DVNs (e.g., LayerZero Labs + Google Cloud + Polyhedra or similar), ensuring that even if one verifier is compromised, a second independent attestation is required. The 1-of-1 configuration reduced the attack's required footprint to compromising a single off-chain operator.

The cascade effect onto Aave and other lending protocols illustrates why bridge security is a systemic DeFi risk, not an isolated protocol risk. rsETH was used as collateral on multiple lending platforms. When the peg broke and rsETH's market price plummeted relative to its stated backing, borrowers who had deposited rsETH as collateral were suddenly under-collateralized on a massive scale, creating bad debt that exceeded liquidation capacity. The $177 million in bad debt on Aave — and the $10 billion withdrawal wave — demonstrates that a bridge misconfiguration can propagate losses through the entire DeFi collateral stack within hours. For a regulated stablecoin issuer like Ripple, whose RLUSD is actively used as a trading and collateral asset, exposure to a similar propagation event would be unacceptable from a regulatory compliance standpoint.

Ripple's existing cross-chain architecture for RLUSD deliberately bypasses traditional bridging by issuing RLUSD natively on both the XRP Ledger and Ethereum. This "dual native issuance" model avoids the lock-and-mint attack surface entirely: there is no bridge contract holding custody of RLUSD supply, no cross-chain message that can be spoofed to authorize minting, and no third-party DVN whose private keys can be compromised. The planned expansion via Wormhole's NTT (Native Token Transfer) standard maintains this philosophy for L2 deployment — NTT uses a burn-and-mint model that preserves Ripple's direct control over supply accounting rather than delegating it to a third-party lock mechanism. The distinction between Wormhole NTT and LayerZero OApp DVN configuration is precisely what Schwartz's public comments were pointing to: not all cross-chain infrastructure is equally trustworthy, and the weakest link is often the DVN configuration chosen by the application developer, not the underlying protocol.

sequenceDiagram
    participant Attacker as Lazarus Group (DPRK)
    participant RPC as Compromised RPC Nodes
    participant DVN as LayerZero DVN (1-of-1)
    participant SrcChain as Source Chain (Unichain)
    participant DstChain as Destination Chain (Ethereum)
    participant Aave as Aave / DeFi Protocols

    Attacker->>RPC: Compromise internal LayerZero RPC nodes
    Attacker->>RPC: DDoS external RPC provider
    Note over RPC: DVN now depends solely on compromised nodes
    RPC->>DVN: Report phantom token burns on Unichain
    Note over DVN: 1-of-1 setup — no secondary verifier to challenge
    DVN->>DstChain: Authorize release of 116,500 rsETH
    DstChain-->>Attacker: 116,500 rsETH (~$292M) minted without backing
    Note over SrcChain: No actual burns occurred
    DstChain->>Aave: rsETH peg breaks — unbacked supply detected
    Aave->>Aave: Freeze rsETH markets on V3 and V4
    Note over Aave: $10B withdrawal wave triggered
    Aave-->>Aave: $177M bad debt created
    Note over DVN: LayerZero blocks 1-of-1 configs going forward
    Note over DVN: Ripple pauses RLUSD DeFi bridge plans

On-Chain & Market Data

The on-chain data tells two parallel stories that are deeply intertwined. The KelpDAO exploit metrics underscore why Ripple's caution is rational from a risk-management perspective: $292 million stolen, $177 million in protocol-level bad debt, and $10 billion in liquidity flight from Aave within 24 hours represents a systemic shock of a scale that could have invalidated RLUSD's entire circulating supply multiple times over. For a stablecoin operating under NYDFS oversight, the reputational and regulatory consequences of being collateral damage in a similar event — even without RLUSD being the primary exploit target — would likely outweigh years of DeFi composability benefits.

The RLUSD growth metrics simultaneously illustrate what is at stake in the decision to pause. A $1.6 billion market cap with 1,278% YTD growth and record transfer volumes demonstrates that RLUSD has achieved genuine product-market fit without deep DeFi composability — for now. But stablecoin market dynamics heavily favor multi-chain liquidity. USDT and USDC maintain dominance not primarily through regulatory superiority but through ubiquitous availability across chains and DeFi protocols. RLUSD's current 0.4% market share ceiling will be difficult to break through without DeFi integration, and every month of bridge pause is a month that competitors like Circle (with its newly launched native USDC Bridge) are locking in liquidity relationships that RLUSD will need to displace later.

Competitive Landscape

Circle (USDC) — Native Bridge Leader, First-Mover Advantage Circle launched its first-party USDC Bridge in April 2026 — almost simultaneously with the KelpDAO exploit — using a proprietary burn-and-mint mechanism that eliminates third-party bridge dependencies entirely. Circle controls the full transfer flow from burn attestation to mint authorization, bypassing DVN configurations and third-party verifier networks altogether. This native model carries lower smart contract risk than any third-party bridge approach and preserves full regulatory control over supply accounting. Circle's Cross-Chain Transfer Protocol (CCTP) V2, which underpins the new bridge, also provides transaction finality guarantees absent from many third-party bridges. The KelpDAO event has effectively validated Circle's architectural choices — and Circle's marketing team has not been slow to draw the contrast. Weakness: Circle's bridge is restricted to USDC, supports a curated set of chains, and may lag community-driven bridge integrations in speed of chain support.

Tether (USDT) — Market Share Incumbent, Security Risk Taker Tether maintains approximately 58.25% of the total stablecoin market ($315B total supply) and achieves its multi-chain presence primarily through third-party bridges and wrapped versions — the exact approach that Ripple is now declining. USDT's bridge risk exposure is substantially higher than RLUSD's by design, and Tether has historically accepted that counterparty risk as the price of liquidity ubiquity. Tether has no equivalent of Schwartz's public security assessment, and Tether's regulatory posture (operating outside U.S. jurisdiction) means that a bridge-related loss would not carry the same regulatory existential risk that it would for Ripple. This asymmetry gives Tether a growth advantage in DeFi markets where security audits are not the primary selection criterion.

Wormhole (NTT Standard) — Ripple's Preferred Bridge Partner Wormhole's Native Token Transfer (NTT) standard is the framework Ripple selected for RLUSD's planned L2 expansion to Optimism, Base, Ink, and Unichain. NTT differs critically from LayerZero OApp configurations: it uses a burn-and-mint model that gives token issuers (like Ripple) direct control over supply accounting rather than delegating custody to a third-party lock contract. This architecture is more aligned with regulated issuer requirements because it preserves Ripple's ability to enforce supply limits and audit trail requirements at the issuance layer. The KelpDAO exploit has not directly implicated Wormhole's NTT standard (it targeted LayerZero infrastructure), giving Ripple's planned Wormhole-based L2 expansion a degree of insulation — though the broader regulatory review process and NYDFS approval timelines remain the binding constraint on that expansion.

LayerZero — Protocol Implicated, Reputation Under Pressure LayerZero finds itself in an uncomfortable position: its protocol is the infrastructure that KelpDAO misconfigured, even though LayerZero's own documentation recommended against the 1-of-1 DVN setup. LayerZero's post-exploit announcement that it will no longer countersign messages from 1/1 DVN applications represents a significant policy shift — essentially removing a configuration option that it had previously permitted. This pivot positions LayerZero as a more security-conscious protocol going forward, but the damage to institutional trust has been done. Ripple's Schwartz specifically cited the bridge-provider pattern of recommending against security features as the core issue, implicating the culture of the entire bridging industry rather than LayerZero specifically. LayerZero's challenge is rebuilding institutional confidence among regulated issuers — a cohort whose participation is increasingly necessary for long-term protocol sustainability.

Stakeholder Analysis

Institutional Investors and Funds For funds holding XRP or RLUSD as part of treasury strategies, Ripple's bridge pause is a net positive in the short term: it reduces tail risk of a catastrophic stablecoin event that could impair RLUSD's peg and Ripple's regulatory standing simultaneously. The RLUSD market cap growth trajectory (~$1.6B with record transfer volumes) demonstrates that the underlying demand drivers are intact. The risk for long-term holders is that prolonged DeFi isolation limits RLUSD's utility expansion, capping its addressable market below the multi-trillion-dollar DeFi liquidity layer. Funds should monitor NYDFS L2 expansion approval timelines and watch for Ripple's selection of a certified DVN architecture standard as signals of when DeFi re-entry will occur.

RLUSD Users and Holders Current RLUSD users — primarily institutional cross-border payments clients, XRP Ledger ecosystem participants, and regulated exchange traders — face minimal immediate disruption from the bridge pause, since RLUSD's primary utility has not yet been DeFi-native. The risk lies in future opportunity cost: if competing stablecoins deepen DeFi liquidity integration and RLUSD remains on the sidelines, RLUSD could become structurally constrained as a payments stablecoin rather than a full DeFi collateral asset. Users who anticipated RLUSD's Optimism and Base deployment within H1 2026 should expect timeline delays linked to both the regulatory review and bridge security recalibration.

DeFi Developers and Protocol Teams For protocols considering RLUSD integration — particularly lending markets like Aave or Compound, or AMMs on L2s — Ripple's security-first posture creates an unusual dynamic. On one hand, RLUSD's regulatory rigor and explicit Ripple backing make it an attractive collateral asset with lower issuer default risk than many alternatives. On the other hand, the bridge pause limits the chains where RLUSD can currently be integrated natively. Developers building on XRP Ledger's native DEX or EVM sidechain have immediate access; developers on Optimism, Base, and other L2s remain in a holding pattern. For protocols that have already integrated rsETH or other bridge-exposed assets and suffered from the KelpDAO cascade, Ripple's security documentation and Schwartz's public commentary provide useful frameworks for re-evaluating their own bridge counterparty risk.

Regulators (NYDFS, SEC, Global) Ripple's public disclosure of its RLUSD bridge evaluation process — and its decision to pause expansion based on security risk assessment — is an unusually transparent act from a regulated financial entity. For NYDFS, it provides evidence that Ripple is conducting thorough security due diligence before deploying regulated financial infrastructure across new chains. This could accelerate the NYDFS approval process for RLUSD's L2 expansion, as regulators tend to respond favorably to issuers who proactively identify and disclose risks. For global regulators watching the stablecoin space, the KelpDAO–RLUSD episode provides a real-world case study in how regulated issuers can and should respond to DeFi systemic risk events — a precedent that may inform emerging stablecoin regulatory frameworks in the EU (MiCA), UK, and APAC.

Risk Assessment

1. Bridge Re-entry Timing Risk — Competitive Displacement — If Ripple's bridge pause extends through H2 2026, competitors (particularly Circle with its native USDC Bridge) will consolidate DeFi liquidity relationships on key L2 networks (Optimism, Base, Arbitrum) that RLUSD will need to displace later. First-mover advantage in stablecoin DeFi integrations is significant: AMMs, lending protocols, and yield strategies build liquidity flywheels around established stablecoins. Severity: High. Probability: Medium-High (given NYDFS approval timelines and bridge architecture recalibration needs, a 6–12 month delay is realistic).

2. Regulatory Overreach Risk — NYDFS Precautionary Restrictions — The KelpDAO exploit may prompt NYDFS to impose prescriptive bridge security requirements on all NYDFS-supervised stablecoin issuers, potentially mandating native issuance standards that create additional compliance costs and timeline friction. While Ripple's proactive disclosure positions it favorably, regulatory response to large-scale DeFi failures can be unpredictable and disproportionate. Severity: Medium-High. Probability: Medium (regulators are attentive to $292M exploit events, and stablecoin legislation is actively being debated in Washington).

3. DVN Industry-Wide Security Standard Lag — Persistent Vulnerability — LayerZero's post-exploit policy change (blocking 1/1 DVN configurations) addresses the specific misconfiguration KelpDAO used but does not resolve the broader industry pattern Schwartz identified: bridge providers systematically recommend against using their own security features. If this culture persists and Ripple evaluates bridge providers again in 12–18 months only to find the same pattern, RLUSD's DeFi expansion could be delayed indefinitely. Severity: High. Probability: Medium (organizational cultures change slowly; the financial incentives for bridge providers to prioritize ease-of-onboarding over security remain intact).

4. RLUSD Collateral Contagion Risk — If It Had Been in DeFi — This is a prospective risk illustrating the upside of Ripple's pause: had RLUSD been deployed via a LayerZero-style bridge at the time of the KelpDAO exploit, it could have been caught in the cascade as collateral on lending platforms like Aave, creating $177M+ in RLUSD bad debt and a potential peg crisis. The regulatory and reputational consequences of such a scenario would have been severe. Ripple's pause mitigates this for now, but the risk re-emerges when RLUSD eventually expands to DeFi — making the choice of bridge architecture at that point critically important. Severity: Catastrophic. Probability: Low (directly tied to Ripple's success in selecting secure bridge architecture at re-entry).

Investment & Strategic Implications

For institutional funds and treasury managers, the KelpDAO–RLUSD episode reframes the stablecoin selection framework. The traditional evaluation criteria — peg stability, issuer regulatory standing, and reserve transparency — must now explicitly include bridge architecture risk as a fourth dimension. RLUSD's dual native issuance model on XRP Ledger and Ethereum, combined with its NYDFS license, positions it as the highest-regulatory-compliance stablecoin currently available in the U.S. market. For institutions with regulatory obligations (banks, broker-dealers, asset managers operating under SEC or CFTC oversight), RLUSD's explicit security-first posture may qualify it as a preferred settlement stablecoin even at the cost of lower DeFi liquidity depth. The key forward catalyst to monitor is Ripple's formal announcement of which bridge architecture and DVN configuration standard it will require as a precondition for DeFi bridge re-entry — that announcement will effectively define the institutional-grade bridge security benchmark for the broader industry.

For DeFi protocol teams and blockchain builders, Schwartz's public commentary constitutes one of the most actionable pieces of institutional-grade bridge security guidance available in the market. The core finding — that bridge providers systematically recommend against using their own security features to reduce operational friction — is a direct indictment of the current bridge vendor evaluation process. Protocols evaluating bridge integrations should explicitly require minimum DVN configurations (at least 2 independent DVNs with distinct operational key management) as a condition of integration, and should demand bridge providers commit to configuration enforcement rather than treating security as optional. This is not merely a prudent DeFi practice; as regulated issuers like Ripple become DeFi counterparties, it will increasingly be a requirement for accessing their liquidity.

For the LayerZero ecosystem specifically, the KelpDAO exploit creates both a crisis and an opportunity. The crisis is obvious: one of the largest DeFi exploits in history occurred on LayerZero infrastructure, and the protocol has now retroactively tightened its configuration standards. The opportunity is less obvious but significant: by proactively banning 1/1 DVN configurations and publishing its best-practice DVN framework, LayerZero has the chance to position itself as the bridge infrastructure standard for regulated issuers — the counterparty that sophisticated institutional players like Ripple would actually trust. Whether LayerZero can convert Schwartz's implicit critique into a constructive institutional partnership will be one of the defining market structure stories of H2 2026.

Outlook: 30 / 180 / 365 Days

• 30 days: LayerZero publishes a formal multi-DVN configuration standard for enterprise applications within 30 days, and at least two other major DeFi protocols (likely Aave or Compound) announce updated bridge counterparty risk frameworks citing the KelpDAO cascade. RLUSD transfer volumes remain near record highs as institutional demand on native XRP Ledger and Ethereum channels continues, independent of DeFi bridge status.

• 180 days: Ripple receives conditional NYDFS approval for L2 expansion via Wormhole NTT by October 2026, contingent on Ripple demonstrating a certified DVN configuration framework that satisfies NYDFS standards. RLUSD reaches $2.5 billion market cap driven by institutional cross-border payments growth, but DeFi liquidity share remains below 5% due to continued bridge restriction. Circle's USDC Bridge establishes first-mover DeFi liquidity positions on Optimism and Base that RLUSD will need to displace.

• 365 days: By May 2027, RLUSD has re-entered DeFi bridging on at least two L2 networks with a documented multi-DVN configuration standard that becomes the industry reference for regulated stablecoin bridge security. If this re-entry is successful and peg stability is maintained through H1 2027, RLUSD's market share grows past 1% of the total stablecoin market (~$3+ billion) as DeFi protocols view it as the only institutional-grade bridge-native stablecoin. In the alternative scenario — regulatory delays or a second major bridge exploit — RLUSD remains a payments-first stablecoin, growing steadily within a narrower TAM.

References

1. Coinpedia — "Ripple CTO Says RLUSD Evaluation Exposed the Same Risk That Drained $292M From Kelp DAO" — https://coinpedia.org/news/ripple-cto-says-rlusd-evaluation-exposed-the-same-risk-that-drained-292m-from-kelp-dao/

2. CoinGape — "XRP News: Ripple CTO Holds Off RLUSD DeFi Bridge Plans Citing KelpDAO-Like Risks" — https://coingape.com/xrp-news-ripple-cto-holds-off-rlusd-defi-bridge-plans-citing-kelpdao-like-risks/

3. Chainalysis — "Inside the KelpDAO Bridge Exploit" — https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/

4. CoinDesk — "Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chains" — https://www.coindesk.com/tech/2026/04/19/2026-s-biggest-crypto-exploit-kelp-dao-hit-for-usd292-million-with-wrapped-ether-stranded-across-20-chains

5. CoinDesk — "The $292 million Kelp exploit: how it happened, and what it means for DeFi" — https://www.coindesk.com/business/2026/04/19/the-usd292-million-kelp-exploit-how-it-happened-and-what-it-means-for-defi

6. CoinPaper — "Ripple CTO Explains Why RLUSD Takes a Security-First Route as KelpDAO's Easy Setup Backfires" — https://coinpaper.com/16398/ripple-cto-explains-why-rlusd-takes-a-security-first-route-as-kelp-dao-s-easy-setup-backfires

7. Bitcoin.com News — "Ripple's Schwartz Flags DeFi Bridge Trade-Offs After KelpDAO Incident" — https://news.bitcoin.com/ripples-schwartz-flags-defi-bridge-trade-offs-after-kelpdao-incident/

8. MoneyCheck — "Ripple CTO David Schwartz Says KelpDAO May Have Skipped Key LayerZero Bridge Safeguards" — https://moneycheck.com/ripple-cto-david-schwartz-says-kelpdao-may-have-skipped-key-layerzero-bridge-safeguards/

9. KuCoin — "KelpDAO rsETH Exploit: How The $292M LayerZero Bridge Attack Created $177M Bad Debt on Aave" — https://www.kucoin.com/blog/kelpdao-rseth-exploit-how-292m-layerzero-bridge-attack-created-177m-bad-debt-in-aave

10. Bitcoinist — "Ripple CTO Emeritus Warns RLUSD Review Exposed A DeFi Security Red Flag" — https://bitcoinist.com/ripple-cto-emeritus-rlusd-defi-security-red-flag/

11. DailyCoin — "Ripple CTO Sounds Alarm On DeFi Security As RLUSD Expands" — https://dailycoin.com/ripple-cto-sounds-alarm-on-defi-security-as-rlusd-expands

12. AMBCrypto — "Here's how $1.6B RLUSD market cap could strengthen XRP's Q2 bull case" — https://ambcrypto.com/heres-how-1-6b-rlusd-market-cap-could-strengthen-xrps-q2-bull-case/

13. Ripple Official — "The Multichain Future is Here: Ripple USD (RLUSD) Expands to L2s with Wormhole's NTT Standard" — https://ripple.com/insights/ripple-usd-rlusd-expands-to-l2s-with-wormhole-ntt-standard/

14. The Block — "Circle rolls out USDC Bridge for native cross-chain stablecoin transfers" — https://www.theblock.co/post/397907/circle-rolls-out-usdc-bridge-for-native-cross-chain-stablecoin-transfers

15. CoinLaw — "RLUSD Statistics 2026: Powering Stablecoin Growth" — https://coinlaw.io/rlusd-statistics/