Security

Arbitrum

LayerZero

Solv Protocol

Ondo

The KelpDAO exploit forced LayerZero to end support for single-verifier security setups and rebuild its default configuration around multiple independent verifiers.&nbsp;On April 18, 2026, attackers linked to North Korea's Lazarus Group stole roughly $292 million in rsETH from KelpDAO's cross-chain bridge by compromising the infrastructure behind LayerZero's verification system, not the smart contracts themselves. The incident pushed LayerZero to admit fault, apologize publicly, and rewrite how it handles high-value applications going forward.<h2 id="span-span-strong-what-happened-in-the-kelpdao-exploit-strong-span-span">What Happened in the KelpDAO Exploit?</h2>KelpDAO is a liquid restaking protocol that lets users stake ETH and receive rsETH, a token representing their staked position, which can then move across chains. To move rsETH between blockchains, KelpDAO relied on LayerZero's messaging system.<ul><li>Attackers gained access to a LayerZero Labs developer's session keys through social engineering, starting March 6, 2026</li><li>They used that access to breach RPC (Remote Procedure Call) nodes, the servers that read and relay blockchain data</li><li>They patched the memory on those nodes so LayerZero's tools saw normal-looking responses while receiving manipulated data</li><li>They launched a denial-of-service attack on an external RPC provider, forcing the system to rely on the compromised node</li><li>The forged data let attackers push a fraudulent cross-chain message, draining 116,500 rsETH worth about $292 million</li></ul>KelpDAO detected the anomaly and blocked the attacker at 18:23 UTC, then reached out to the Security Alliance's SEAL 911 emergency response team at 18:34 UTC, both within roughly an hour of the incident starting, according to SEAL's own incident log.&nbsp;The quick response also blocked a second attempt to steal an additional 40,000 rsETH, worth about $95 million, using a follow-up forged packet. The Arbitrum Security Council separately froze more than 30,000 ETH of the attacker's downstream funds.<h2 id="span-span-strong-a-look-into-single-verifier-setup-strong-span-span">A Look Into Single-Verifier Setup</h2>LayerZero's security model depends on Decentralized Verifier Networks, or DVNs, which confirm that a cross-chain message is legitimate before the destination chain acts on it.<h3 id="span-span-strong-the-1-1-configuration-problem-strong-span-span">The 1/1 Configuration Problem</h3>KelpDAO ran a 1-of-1 DVN configuration, meaning a single verifier, operated by LayerZero Labs, was enough to approve a transaction. LayerZero had recommended multi-verifier setups requiring consensus across independent DVNs, which would have made the forged message ineffective even with one compromised verifier. KelpDAO used the single-verifier option anyway.<h3 id="span-span-strong-a-disputed-responsibility-strong-span-span">A Disputed Responsibility</h3>LayerZero initially said the protocol "functioned exactly as intended" and placed responsibility on KelpDAO's configuration choice. KelpDAO pushed back, pointing to LayerZero's own onboarding documents and quickstart examples, which listed the single-verifier setup as a standard option. About three weeks after the attack, LayerZero reversed its position, stating it "made a mistake" by letting its DVN act as a sole verifier for high-value transactions and apologizing for its handling of the response.<h2 id="span-span-strong-what-security-changes-has-layerzero-made-strong-span-span">What Security Changes Has LayerZero Made?</h2>LayerZero announced several concrete changes following the exploit:<ul><li>The LayerZero Labs DVN no longer services any 1/1 configuration</li><li>Default pathways now require five verifiers where available, with a floor of three on chains that only support three DVNs</li><li>A second DVN client, written in Rust, is being built for client-level diversity</li><li>RPC infrastructure has been reconfigured for more granular quorum controls</li><li>LayerZero's own multisig threshold is being raised from 3-of-5 to 7-of-10 using OneSig, an open-source multisig tool</li></ul>LayerZero is also recommending that applications pin their own security configurations rather than rely on defaults, set block confirmations high enough to make reorganization effectively impossible, and consider running their own DVN as a required verifier.<h2 id="span-span-strong-how-has-the-market-reacted-strong-span-span">How Has the Market Reacted?</h2>KelpDAO has since moved its rsETH bridge to Chainlink's Cross-Chain Interoperability Protocol, and Solv Protocol shifted more than $700 million in tokenized bitcoin infrastructure away from LayerZero.&nbsp;But the protocol also gained a notable vote of confidence: on May 14, 2026, Fidelity's FCAT deployed an institutional-grade DVN on LayerZero, with Ondo Finance as its first integrator. LayerZero has said more than $9 billion moved across the protocol without incident in the weeks following the exploit, on an architecture it says has processed over $260 billion in total volume.&nbsp;As of late August 2026, ZRO, LayerZero's native token, trades near $1.17 to $1.21, up sharply over the past week, with a market cap around $415 million to $450 million, still well below its December 2024 high of $7.51.<h2 id="span-span-strong-conclusion-strong-span-span">Conclusion</h2>The KelpDAO exploit showed that a blockchain's smart contracts can stay untouched while an off-chain trust layer still fails. LayerZero has since eliminated single-verifier configurations, raised its default verifier count, diversified its verifier software, and tightened its own internal multisig controls.&nbsp;The episode cost LayerZero two major integrations, drew a new institutional verifier onto the network, and renewed scrutiny of how cross-chain protocols document security defaults for developers.<h2 id="span-span-strong-resources-strong-span-span">Resources</h2><ol><li><a style="text-decoration:none" href="https://layerzero.network/blog/kelpdao-incident-statement" rel="noopener noreferrer nofollow">Incident statement by LayerZero</a>: Official summary of the April 18, 2026 KelpDAO exploit and initial attribution</li><li><a style="text-decoration:none" href="https://layerzero.network/blog/an-overdue-apology" rel="noopener noreferrer nofollow">Update by LayerZero</a>: LayerZero's public apology and detailed list of post-exploit security changes</li><li><a style="text-decoration:none" href="https://radar.securityalliance.org/initial-takeaways-layerzero-dvn-incident/" rel="noopener noreferrer nofollow">Incident analysis by Security Alliance (SEAL)</a>: Independent incident timeline and DVN configuration recommendations</li><li><a style="text-decoration:none" href="https://www.coindesk.com/tech/2026/05/09/layerzero-says-it-made-a-mistake-in-usd292-million-kelp-exploit" rel="noopener noreferrer nofollow">Report by CoinDesk</a>: LayerZero's reversal and admission of fault three weeks after the exploit</li><li><a style="text-decoration:none" href="https://crypto.news/layerzero-details-292m-kelpdao-exploit-and-tightens-bridge-security/" rel="noopener noreferrer nofollow">Report by crypto.news</a>: Full breakdown of the exploit mechanics and LayerZero's tightened bridge security policy</li><li><a style="text-decoration:none" href="https://www.chainalysis.com/blog/kelpdao-bridge-exploit-april-2026/" rel="noopener noreferrer nofollow">Analysis by Chainalysis</a>: On-chain breakdown of the attack timeline and KelpDAO's incident response</li><li><a style="text-decoration:none" href="https://www.coindesk.com/web3/2026/05/05/kelp-claims-that-layerzero-approved-the-setup-it-blamed-for-usd292-million-bridge-hack" rel="noopener noreferrer nofollow">Report by CoinDesk</a>: KelpDAO's dispute of LayerZero's account of responsibility</li><li><a style="text-decoration:none" href="https://www.fcatalyst.com/trends-and-signals/fcat-deploys-decentralized-verifier-network-dvn-on-layerzero-protocol-with-ondo-as-an-early-integrator" rel="noopener noreferrer nofollow">Announcement by FCAT</a>: Fidelity's institutional DVN deployment on LayerZero with Ondo Finance</li><li><a style="text-decoration:none" href="https://www.coinbase.com/price/zro" rel="noopener noreferrer nofollow">ZRO price data by Coinbase</a>: Live LayerZero token price, market cap, and circulating supply</li></ol>

How Did the KelpDAO Exploit Reshape LayerZero’s Security Model?

Table of Contents

BSCN

Other articles published on Aug 28, 2026

SEC sues 38 entities over fake adviser filings

Jared Johnston warns XRP holders of sell trap at $32, cites whale activity

Evernorth says SEC registration effective, clearing path for Nasdaq listing

Inside LUNC's Community-Run Burn Tax: Does Burning Dead Supply Actually Work?

Inside Sei Network's Giga Upgrade and Its Race Toward 200,000 TPS

How Do Leveraged Dogecoin ETFs Work?

Join our free newsletter for daily crypto updates!