Nexus

LayerZero

Security

<p>LayerZero Labs has released its incident report on the KelpDAO bridge attack, saying about $292 million in rsETH was stolen after attackers poisoned RPC infrastructure used by its verification network and forcing policy changes around single-signer configurations.</p>
<div id="cn-block-summary-block_da128fed9f803f4a5133d4d2686de6a2" class="cn-block-summary">
 <div class="cn-block-summary__nav tabs"><span>Summary</span>
 </div>
 <div class="cn-block-summary__content">
  <ul>
   <li>LayerZero said KelpDAO was exploited for about $290 million, or roughly 116,500 rsETH, in an attack isolated to rsETH’s single-DVN setup.</li>
   <li>The company said preliminary indicators point to North Korea-linked TraderTraitor and described the exploit as an infrastructure compromise rather than a protocol flaw.</li>
   <li>LayerZero said it will stop signing messages for applications using 1/1 DVN configurations and is pushing affected integrators toward multi-DVN redundancy.</li>
  </ul>
 </div>
</div>
<p>LayerZero Labs has published a detailed account of the KelpDAO exploit, confirming that attackers stole roughly 116,500 rsETH, worth about $292 million, by compromising downstream infrastructure tied to the verification layer used in KelpDAO’s cross-chain configuration.</p>
<p>The company said the incident was limited to KelpDAO’s rsETH setup because the application relied on a 1-of-1 DVN configuration with LayerZero Labs as the sole verifier, a design LayerZero said directly contradicted its standing recommendation that applications use diversified multi-DVN setups with redundancy.</p>
<p>In its statement, <a href="https://layerzero.network/blog/kelpdao-incident-statement" rel="noopener noreferrer nofollow">LayerZero</a> said there was “zero contagion to any other cross-chain assets or applications,” arguing that the protocol’s modular security architecture contained the blast radius even as a single application-level configuration failed.</p>
<h2 class="wp-block-heading" id="how-the-attack-worked">How the attack worked</h2>
<p>According to <a href="https://layerzero.network/blog/kelpdao-incident-statement" rel="noopener noreferrer nofollow">LayerZero’s report</a>, the April 18, 2026 attack targeted the RPC infrastructure relied on by the LayerZero Labs DVN rather than exploiting the LayerZero protocol, key management, or the DVN software itself.</p>
<p>The company said the attackers gained access to the list of RPCs used by the DVN, compromised two nodes running on separate clusters, replaced binaries on op-geth nodes, and then used malicious payloads to feed forged transaction data to the verifier while returning truthful data to other endpoints, including internal monitoring services.</p>
<p>To complete the exploit, the attackers also launched <a href="https://crypto.news/manta-network-hit-with-now-resolved-ddos-attack/" rel="noopener noreferrer nofollow">DDoS</a> attacks on uncompromised RPC endpoints, which triggered failover toward the poisoned nodes and allowed the LayerZero Labs DVN to confirm transactions that had never actually occurred.</p>
<p>Outside forensic work broadly matches that description. <a href="https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/" rel="noopener noreferrer nofollow">Chainalysis</a> said the attackers linked to North Korea’s <a href="https://crypto.news/lazarus-group-intensifies-attacks-on-crypto-browser-extensions-group-ib/" rel="noopener noreferrer nofollow">Lazarus Group</a>, specifically TraderTraitor, did not exploit a smart contract bug but instead forged a cross-chain message by poisoning internal RPC nodes and overwhelming external ones in a single-point-of-failure verification setup.</p>
<h2 class="wp-block-heading" id="security-changes">Security changes</h2>
<p>LayerZero said the immediate response included deprecating and replacing all affected RPC nodes, restoring the LayerZero Labs DVN to operation and contacting law enforcement agencies while working with industry partners and Seal911 to trace the stolen funds.</p>
<p>You might also like: <a href="https://crypto.news/140k-in-less-than-24-hours-meme-punchs-battle-arena-is-drawing-a-crowd-before-launch/" rel="noopener noreferrer nofollow"> $140k in less than 24 hours: Meme Punch’s battle arena is drawing a crowd before launch </a></p>
<p>More importantly, the company is changing how it handles risky configurations. In the statement, LayerZero said its DVN “will not sign or attest messages from any applications that utilize a 1/1 configuration,” a direct policy shift aimed at preventing a repeat of the KelpDAO failure mode.</p>
<p>The company is also reaching out to projects still using 1/1 configurations to migrate them to multi-DVN models with redundancy, effectively admitting that configuration flexibility without enforced safety rails was too permissive in practice.</p>
<p>The attribution picture has also hardened. Chainalysis linked the exploit to North Korea’s Lazarus Group and specifically TraderTraitor, while Nexus Mutual said the forged message drained $292 million from KelpDAO’s bridge in under 46 minutes, making it one of 2026’s biggest DeFi losses.</p>
<p>The result is a familiar but brutal lesson for cross-chain infrastructure: the smart contracts can survive intact and the protocol can still fail in practice if the off-chain trust layer is weak enough. <a href="https://crypto.news/kraken-migrates-to-chainlink-ccip-for-kbtc/" rel="noopener noreferrer nofollow">LayerZero</a> is now trying to prove that the right takeaway from a $292 million bridge theft is not that modular security failed, but that letting anyone run a single-signer setup was the real mistake.</p>
<p>Read more: <a href="https://crypto.news/eu-opens-mica-consultation-as-bloc-reviews-crypto-rulebook/" rel="noopener noreferrer nofollow"> EU opens MiCA consultation as bloc reviews crypto rulebook </a></p>

LayerZero details $292M KelpDAO exploit and tightens bridge security

Table of Contents

crypto.news

Other articles published on May 20, 2026

Join our free newsletter for daily crypto updates!