LayerZero Apologizes: Acknowledges DVN Single Validation as a Serious Mistake, Plans Multiple Security Upgrades

May 9: LayerZero Labs issued a belated apology for security incidents over the past three weeks, acknowledging insufficient communication and revealing its DVN’s internal RPC endpoint was compromised by North Korea-linked hacker group Lazarus—leading to data corruption—while an external RPC provider was targeted in a DDoS attack. The LayerZero core protocol itself remained unaffected, but the team admitted allowing its in-house DVN to operate in 1/1 single-validator mode for high-value transactions was a critical error. The incident impacted just one application, which represents 0.14% of the network’s total apps and 0.36% of its asset value. LayerZero stressed its protocol is designed to eliminate single points of failure, enabling each app to independently manage end-to-end security without relying on LayerZero Labs—a key driver of the protocol’s widespread adoption by major asset issuers. Recommendations for developers: immediately update configurations, increase block confirmation requirements, and configure at least 2–5 DVNs (preferably running their own and designating them as mandatory validators). Going forward, LayerZero Labs will no longer support 1/1 DVN setups, with a default migration to 3/3 or 5/5 configurations; develop a new Rust-based client; and launch the OneSig multisig system and Console unified management platform to help devs enhance security practices.