LayerZero

April

would

<ul>
 <li>Attack used poisoned RPC nodes to manipulate LayerZero DVN, enabling fake transaction validation without breaching core protocol systems.</li>
 <li>KelpDAO’s single-verifier setup created a critical failure point, allowing attackers to exploit rsETH without multi-layer validation safeguards.</li>
 <li>LayerZero restored systems, dropped risky configs, and works with authorities as industry reviews infrastructure security and RPC dependencies.</li>
</ul>
<p>A $290 million <a href="https://x.com/LayerZero_Core/status/2046081551574983137?s=20" rel="noopener noreferrer nofollow">exploit</a> struck KelpDAO on April 18, 2026, after attackers manipulated infrastructure tied to LayerZero, according to the project. The incident targeted rsETH and relied on poisoned RPC nodes. However, LayerZero said the breach remained isolated, with no impact on other applications or cross-chain assets.</p>
<h2 class="wp-block-heading" id="strong-attack-traced-to-compromised-rpc-infrastructure-strong"><strong>Attack Traced to Compromised RPC Infrastructure</strong></h2>
<p>According to <a href="https://cryptofrontnews.com/cardano-faces-pressure-despite-major-layerzero/" rel="noopener noreferrer nofollow">LayerZero</a>, the attacker targeted its Decentralized Verifier Network, or DVN, through external infrastructure rather than protocol code. Specifically, the operation poisoned downstream RPC nodes used for transaction verification. Two independent RPC nodes were compromised, allowing attackers to inject malicious data.</p>
<p>However, the attacker still faced additional barriers. To complete the exploit, they launched DDoS attacks on healthy RPC nodes. This forced the system to rely on compromised endpoints. As a result, the DVN validated transactions that never occurred.</p>
<p>LayerZero stated the attack likely links to the Lazarus Group, particularly the TraderTraitor unit. The method relied on spoofed RPC responses that appeared normal to monitoring systems. Notably, the malicious setup erased traces after execution.</p>
<h2 class="wp-block-heading" id="strong-single-verifier-setup-exposed-rseth-strong"><strong>Single Verifier Setup Exposed rsETH</strong></h2>
<p>The breach focused entirely on rsETH issued by KelpDAO. According to LayerZero, KelpDAO used a single-DVN configuration at the time. This meant one verifier handled all validation, creating a single point of failure.</p>
<div id="media_image-7" class="widget widget_media_image cfn-widget cfn-banner cfn-banner-article cfn-banner_728"><a href="https://t.me/EliteFXLabs" rel="noopener noreferrer nofollow"><img width="1280" height="698" src="https://cryptofrontnews.com/wp-content/uploads/2026/04/EliteFXLabsBanner-0.webp" alt="EliteFXLabs Banner"></a>
</div>
<p>LayerZero noted it had recommended multi-DVN setups with redundancy across independent verifiers. However, <a href="https://cryptofrontnews.com/aave-freezes-rseth-markets-after-200m-exploit-shock/" rel="noopener noreferrer nofollow">KelpDAO</a> maintained a 1-of-1 configuration. Without additional verification layers, the forged message passed unchecked.</p>
<p>Importantly, LayerZero confirmed no vulnerability existed within its protocol or core systems. Instead, the failure occurred at the application configuration level.</p>
<h2 class="wp-block-heading" id="strong-systems-restored-as-investigation-continues-strong"><strong>Systems Restored as Investigation Continues</strong></h2>
<p>Following the incident, LayerZero replaced all affected RPC nodes and restored its DVN operations. The team also began contacting projects using similar single-verifier setups. It stated these configurations would no longer receive support from its DVN.Additionally, LayerZero confirmed coordination with global <a href="https://cryptofrontnews.com/pakistan-lifts-crypto-ban-banks-open-doors-again-after-8-year-freeze/" rel="noopener noreferrer nofollow">law enforcement</a> agencies. It is also working with industry partners to track stolen funds. Meanwhile, the protocol continues reviewing data tied to the exploit.</p>
<p>The post <a href="https://cryptofrontnews.com/layerzero-confirms-290m-kelpdao-exploit-tied-to-rpc-attack/" rel="noopener noreferrer nofollow">LayerZero Confirms $290M KelpDAO Exploit Tied to RPC Attack</a> appears on <a href="https://cryptofrontnews.com" rel="noopener noreferrer nofollow">Crypto Front News</a>. Visit our website to read more interesting articles about cryptocurrency, blockchain technology, and digital assets.</p>

LayerZero Confirms $290M KelpDAO Exploit Tied to RPC Attack

Table of Contents

CFN

Other articles published on Apr 20, 2026

Join our free newsletter for daily crypto updates!