LayerZero

April

<ul>
 <li>LayerZero said TraderTraitor compromised a developer account before manipulating internal RPC infrastructure.</li>
 <li>The rsETH exploit drained 116,500 rsETH after a forged transaction passed a single-verifier setup.</li>
 <li>LayerZero rebuilt affected systems and added stricter credential, approval, and verifier security controls.</li>
</ul>
<p>LayerZero released a joint post-mortem with Mandiant and CrowdStrike detailing the April 18 rsETH bridge exploit that drained 116,500 rsETH, worth about $292 million. According to the report, DPRK-linked threat actor TraderTraitor, also known as UNC4899, <a href="https://layerzero.network/blog/layerzero-labs-kelpdao-incident-report" rel="noopener noreferrer nofollow">compromised</a> LayerZero infrastructure after targeting a developer in March. The attack later manipulated RPC nodes and forced a verifier system failure that approved a forged crosschain transaction.</p>
<figure class="wp-block-embed is-type-rich is-provider-twitter wp-block-embed-twitter">
 <div class="wp-block-embed__wrapper">
  https://twitter.com/LayerZero_Core/status/2057085190565224699?s=20
 </div>
</figure>
<h2 class="wp-block-heading" id="strong-attack-began-with-developer-compromise-strong"><strong>Attack Began With Developer Compromise</strong></h2>
<p>According to LayerZero, the breach started on March 6 after an attacker socially engineered a LayerZero Labs developer. The attacker harvested session keys before entering LayerZero’s RPC cloud environment.</p>
<p>From there, the attacker altered internal RPC node memory with malicious software. The modified system returned legitimate responses to monitoring tools.</p>
<p>However, the same nodes sent manipulated responses to <a href="https://cryptofrontnews.com/kelpdao-blames-layerzero-in-300m-bridge-fallout/" rel="noopener noreferrer nofollow">LayerZero</a> Labs’ Decentralized Verifier Networks, also known as DVNs. RPC nodes process blockchain state requests across networks.</p>
<p>To expand the attack, the threat actor launched a Denial of Service attack against an external RPC provider. Consequently, the LayerZero Labs signing service relied on two compromised internal nodes.</p>
<p>According to Mandiant, CrowdStrike, and independent researchers, the forged message later received a valid attestation. As a result, the KelpDAO rsETH bridge released the assets.</p>
<h2 class="wp-block-heading" id="strong-single-verifier-setup-enabled-exploit-strong"><strong>Single-Verifier Setup Enabled Exploit</strong></h2>
<p>LayerZero stated the affected OApp relied on a single-verifier configuration during the incident. Therefore, no second independent DVN reviewed the forged message.</p>
<div id="media_image-7" class="widget widget_media_image cfn-widget cfn-banner cfn-banner-article cfn-banner_728"><a href="https://t.me/EliteFXLabs" rel="noopener noreferrer nofollow"><img width="1280" height="698" src="https://cryptofrontnews.com/wp-content/uploads/2026/04/EliteFXLabsBanner-0.webp" alt="EliteFXLabs Banner"></a>
</div>
<p>The destination contract accepted the single attestation and unlocked <a href="https://cryptofrontnews.com/aave-and-kelp-restore-rseth-bridging-after-exploit/" rel="noopener noreferrer nofollow">rsETH</a> assets. However, LayerZero said no other OApps, channels, or transactions suffered compromise.</p>
<p>Following the breach, LayerZero changed how its DVN system handles channel security requirements. The company said its DVN will no longer sign as the sole required attestor.</p>
<h2 class="wp-block-heading" id="strong-layerzero-rebuilds-compromised-infrastructure-strong"><strong>LayerZero Rebuilds Compromised Infrastructure</strong></h2>
<p>LayerZero also replaced the affected cloud environment instead of patching existing systems. The company rebuilt the infrastructure using hardened configurations and removed legacy credentials.</p>
<p>Additionally, LayerZero introduced short-lived credentials and <a href="https://cryptofrontnews.com/aave-restores-weth-borrowing-across-six-networks/" rel="noopener noreferrer nofollow">multi-person approval requirements</a> for administrative access changes. The company also added device and session validation checks.</p>
<p>According to LayerZero, CrowdStrike, Mandiant, and zeroShadow continue supporting the investigation alongside law enforcement agencies.</p>
<p>The post <a href="https://cryptofrontnews.com/layerzero-details-292m-rseth-bridge-exploit/" rel="noopener noreferrer nofollow">LayerZero Details $292M rsETH Bridge Exploit</a> appears on <a href="https://cryptofrontnews.com" rel="noopener noreferrer nofollow">Crypto Front News</a>. Visit our website to read more interesting articles about cryptocurrency, blockchain technology, and digital assets.</p>

LayerZero Details $292M rsETH Bridge Exploit

Table of Contents

CFN

Other articles published on May 21, 2026

Join our free newsletter for daily crypto updates!