Orbit

Rally

LayerZero

Cross-chain messaging firm LayerZero<a href="https://yellow.com/asset/zro" rel="noopener noreferrer nofollow">(ZRO)</a> has attributed the $292 million Kelp DAO exploit to <a href="https://yellow.com/news/coindcx-hack-traced-to-north-koreas-lazarus-group-dollar44m-stolen" rel="noopener noreferrer nofollow">North Korea's Lazarus Group</a>, pointing to a single-verifier setup.
<h2 id="kelp-dao-exploit-details">Kelp DAO Exploit Details</h2>
The company <a href="https://www.binance.com/en/square/post/314441048711377" rel="noopener noreferrer nofollow">released</a> a post-mortem on Apr. 20 tied to the Apr. 18 drain of 116,500 rsETH<a href="https://yellow.com/asset/rseth" rel="noopener noreferrer nofollow">(RSETH)</a> from Kelp's bridge, per a statement carried by Binance News.
LayerZero said attackers, tied to Lazarus subgroup TraderTraitor, poisoned downstream RPC infrastructure. They seized control of some nodes, then used DDoS traffic to redirect the system to malicious endpoints and forge cross-chain transactions.
The firm stressed that the breach was limited to Kelp's rsETH application, which ran a single decentralized verifier network, or DVN, instead of the recommended multi-DVN setup. Affected RPC nodes have been swapped out, and the DVN is back online.
Also Read:<a href="https://yellow.com/news/bitcoin-floor-next-rally-or-drop" rel="noopener noreferrer nofollow">Bitcoin At $74,900 — Is This The Floor Before The Next Rally Or A Ledge Before A Drop?</a>
<h2 id="lazarus-attack-fallout">Lazarus Attack Fallout</h2>
Onchain sleuth ZachXBT first <a href="https://coincentral.com/292-million-gone-in-46-minutes-inside-the-kelp-dao-defi-hack/" rel="noopener noreferrer nofollow">flagged</a> the breach, noting attacker wallets were pre-funded through Tornado Cash. Cyvers CEO Deddy Lavid said the hit shows the risks of DeFi composability.
LayerZero is now accelerating the migration of single-DVN apps to multi-DVN setups and has paused signing for 1-of-1 configurations.
The incident is 2026's largest DeFi hack so far. It follows the Apr. 1 drain of roughly <a href="https://yellow.com/news/drift-protocol-exploit-solana" rel="noopener noreferrer nofollow">$285 million from Solana-based Drift Protocol</a>, also tied to North Korea-linked actors, part of a two-week stretch that has seen more than $600 million leave DeFi across over ten protocols.
Read Next:<a href="https://yellow.com/news/asteroid-shiba-price-surge-explained" rel="noopener noreferrer nofollow">The Meme Coin That Shot Into Orbit — Asteroid Shiba's 600% Mystery Explained</a>

Lazarus Group Tied To $292M Kelp DAO Hack As LayerZero Points To Config Flaw

Table of Contents

Yellow News

Other articles published on Apr 20, 2026

Join our free newsletter for daily crypto updates!