LayerZero Releases rsETH Exploit Incident Report: Full Reconstruction of Affected Infrastructure, Security Configuration Enhancement

May 20th — LayerZero has released its incident report on the KelpDAO rsETH exploit. The KelpDAO rsETH bridge, built on LayerZero’s cross-chain messaging protocol, was breached on April 18, resulting in the theft of approximately 116,500 rsETH (valued at around $292 million). Multiple security firms have attributed the attack to the North Korean hacker group TraderTraitor (also known as UNC4899). Notably, the incident did not impact LayerZero’s core protocol or other decentralized applications (OApps)—it targeted exclusively KelpDAO’s bridge, which relied on a single validator setup. The attack timeline began on March 6: Threat actors used social engineering to steal session keys from LayerZero developers, infiltrated their RPC cloud environment, and poisoned internal RPC nodes. These nodes were patched to return normal responses to monitoring tools while feeding falsified blockchain state data to LayerZero’s Decentralized Validator Network (DVN). Next, the attacker launched a denial-of-service (DoS) attack on external RPC providers, forcing the DVN to rely entirely on the compromised internal nodes. This allowed the threat actors to generate valid proofs for fraudulent cross-chain messages. Because KelpDAO’s bridge used only one validator, the target contract accepted the sole proof and unlocked the stolen rsETH. In response to the breach, LayerZero has taken key corrective measures: 1. Revised its operational stance: Mandating that channels used by its DVN must meet minimum security requirements, specifically banning the use of a single validator for signature validation. 2. Fully rebuilt affected infrastructure: Adopting a zero-trust architecture and real-time privilege escalation mechanisms. 3. Continued collaborating with ecosystem partners to strengthen security configurations, while also working closely with law enforcement and security firms to advance the investigation, attribution of the hack, and tracing of stolen funds.