Aave

DeFi

Bitcoin

LayerZero

Read

<p><strong>LayerZero said North Korea’s Lazarus Group is the likely actor behind the Kelp DAO exploit that drained 116,500 rsETH worth about $292 million.&nbsp;</strong></p>
<div id="cn-block-summary-block_8af2498180026b8447388cfe28b99c11" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>LayerZero said Lazarus likely led the Kelp DAO exploit that drained 116,500 rsETH worth $292 million.</li>
   <li>LayerZero blamed Kelp DAO’s single-DVN setup, saying no backup verifier blocked the forged cross-chain message.</li>
   <li>The exploit triggered over $10 billion in Aave outflows and a wider DeFi TVL drop.</li>
  </ul>
 </div>
</div>
<p>The company said early indicators point to a “highly-sophisticated state actor” and named “DPRK’s Lazarus Group, more specifically TraderTraitor” in its latest statement.</p>
<p>The <a href="https://crypto.news/kelp-attack-spreads-risk-across-defi-293m-lost/" rel="noopener noreferrer nofollow">attack</a> took place on April 18 and quickly became the largest DeFi exploit reported this year. LayerZero said the attacker targeted the system used to verify cross-chain messages, which allowed a false message to pass through and unlock tokens on the bridge.</p>
<p>You might also like: <a href="https://crypto.news/easydns-admits-to-security-failure-following-eth-limo-domain-hijack/" rel="noopener noreferrer nofollow"> EasyDns admits to security failure following eth.limo domain hijack </a></p>
<h1 class="wp-block-heading" id="strong-attack-centered-on-node-access-and-message-forgery-strong"><strong>Attack centered on node access and message forgery</strong></h1>
<p>LayerZero <a href="https://x.com/LayerZero_Core/status/2046081551574983137?s=20" rel="noopener noreferrer nofollow">said</a> the attacker got access to the list of RPC nodes used by LayerZero Labs’ decentralized verified network, or DVN. According to the company, the attacker then poisoned two of those nodes so they delivered a fake cross-chain message to the verifier network.</p>
<p>At the same time, the attacker launched a DDoS attack against clean nodes, which pushed the DVN to rely on the poisoned nodes. LayerZero said this combination allowed the forged message to move through the system and trigger the token unlock that led to the <a href="https://crypto.news/crypto-hacks-drained-1-5b-from-industry-in-2024-and-2025-26-is-already-worse/" rel="noopener noreferrer nofollow">loss</a>.</p>
<p>In addition, LayerZero said the damage became possible because Kelp DAO used a single 1-of-1 DVN setup with no backup verifier. The company said this created a single point of failure, leaving no independent check to reject the fake message before the bridge released funds.</p>
<p>In its statement, LayerZero said “operating a single-point-of-failure configuration meant there was no independent verifier to catch and reject a forged message.” It also said “LayerZero and other external parties previously communicated best practices around DVN diversification to KelpDAO.” The company added that it will no longer sign messages for applications that use a 1/1 DVN setup.</p>
<h2 class="wp-block-heading" id="strong-aave-outflows-and-defi-pressure-follow-exploit-strong"><strong>Aave outflows and DeFi pressure follow exploit</strong></h2>
<p>The exploit spread stress across DeFi after the attacker moved stolen rsETH to Aave V3 and used it as collateral to borrow large amounts of WETH. This raised concern over possible bad debt on Aave and led the protocol to freeze rsETH markets on both V3 and V4.</p>
<p>Aave founder Stani Kulechov <a href="https://x.com/StaniKulechov/status/2045595382986559987" rel="noopener noreferrer nofollow">said</a> “RsETH has been frozen on Aave V3 and V4” and added that the asset no longer has borrowing power because of the Kelp DAO bridge exploit. Historical data from Aavescan <a href="https://aavescan.com/protocol/totals" rel="noopener noreferrer nofollow">showed</a> more than $10 billion left Aave after the attack, with total supplied funds falling to $35.7 billion from $45.8 billion.</p>
<p>The fallout extended beyond Aave. Several DeFi protocols, <a href="https://x.com/CatfishFishy/status/2045957724538650624" rel="noopener noreferrer nofollow">including</a> Ethena, ether.fi, Tron DAO, and Curve Finance, paused LayerZero OFT bridges as a precaution.&nbsp;</p>
<p>DefiLlama data showed DeFi total value locked dropped 7% in 24 hours to about $86.3 billion, down from $99.5 billion on April 18. LayerZero said there is “zero contagion” for other assets or applications using multi-DVN setups, while law enforcement efforts to trace the funds continue.</p>
<p>Read more: <a href="https://crypto.news/michael-saylor-hints-at-new-bitcoin-buy-as-strategy-nears-800000-btc/" rel="noopener noreferrer nofollow"> Michael Saylor hints at new Bitcoin buy as Strategy nears 800,000 BTC </a></p>

LayerZero links Kelp DAO exploit to Lazarus as DeFi losses deepen

Table of Contents

crypto.news

Other articles published on Apr 20, 2026

Join our free newsletter for daily crypto updates!