LayerZero Report on KelpDAO Hack: Confirmed to Only Affect rsETH Pool

April 20: LayerZero Labs released an incident report stating KelpDAO was attacked on April 18, leading to losses of roughly $290 million. Preliminary analysis links the attack to North Korea’s Lazarus Group—specifically the threat actor known as TraderTraitor. The attack compromised the downstream RPC infrastructure of the Decentralized Validation Network (DVN). The attacker controlled some RPC nodes, coordinated a DDoS attack to trick the system into switching to malicious nodes, and forged cross-chain transactions. All affected RPC nodes have been taken offline and replaced, and the DVN is now operational again. LayerZero emphasized the incident was isolated to KelpDAO’s rsETH application configuration and did not impact other assets or apps. This stemmed from KelpDAO using a single-DVN (1/1) architecture at the time and failing to implement LayerZero’s recommended redundant multi-DVN setup, leaving it without independent validation nodes to detect forged messages. LayerZero noted its core protocol had no vulnerabilities, apps with multi-DVN setups were unharmed, and there is no systemic risk. LayerZero announced it is urging all projects on single-DVN setups to migrate to multi-DVN architectures as soon as possible. It has also suspended signature and verification services for 1/1 configuration apps. Additionally, the firm is working with global law enforcement on the investigation and helping industry partners trace the stolen funds. LayerZero stated the incident underscores the value of modular security architecture and serves as a reminder for the industry to watch for potential risks in RPC validation paths.