LayerZero said the attackers compromised two RPC nodes the company's verifier relied on and DDoS'd the rest, with the attack working only because Kelp had ignored multi-verifier recommendations.
LayerZero said the attackers compromised two RPC nodes the company's verifier relied on and DDoS'd the rest, with the attack working only because Kelp had ignored multi-verifier recommendations. LayerZero blamed the $290 million Kelp DAO exploit on Kelp's decision to use a single-verifier configuration, despite prior warnings to adopt a multi-verifier setup.
Attackers, whom LayerZero preliminarily linked to North Korea's Lazarus Group, compromised two RPC nodes and used a DDoS attack to force failover, tricking LayerZero's verifier into approving a fraudulent cross-chain transaction. LayerZero said the incident stemmed from Kelp's security choices rather than a protocol-level bug, has found no contagion to other applications, and will no longer sign messages for any project using a 1-of-1 verifier configuration. LayerZero has placed responsibility for the $290 million Kelp DAO exploit on Kelp's own security configuration, saying the liquid restaking protocol ran a single-verifier setup that LayerZero had previously warned against.Attackers, whom LayerZero attributed with preliminary confidence to North Korea's Lazarus Group and its TraderTraitor subunit, compromised two of the remote procedure call nodes that LayerZero's verifier relied on to confirm cross-chain transactions. RPC nodes are the servers that let software read and write data on a blockchain, and LayerZero's verifier used a mix of internal and external ones for redundancy. The attackers swapped the binary software running on two of those nodes with malicious versions designed to tell LayerZero's verifier that a fraudulent transaction had occurred, while continuing to report accurate data to every other system querying those same nodes. That selective lying was engineered to keep the attack invisible to LayerZero's own monitoring infrastructure, which queries the same RPCs from different IP addresses. Compromising two nodes was not enough. LayerZero's verifier also queried uncompromised external RPC nodes, so the attackers ran a distributed denial-of-service attack on those to force failover to the poisoned ones. Traffic logs LayerZero shared show the DDoS running between 10:20 a.m. and 11:40 a.m. Pacific Time on Saturday. Once the failover triggered, the compromised nodes told the verifier a valid cross-chain message had arrived, and Kelp's bridge released 116,500 rsETH to the attackers. The malicious node software then self-destructed, wiping binaries and local logs. The attack only worked because Kelp ran a 1-of-1 verifier configuration, meaning LayerZero Labs was the sole entity verifying messages to and from the rsETH bridge. LayerZero's public integration checklist and direct communications to Kelp had recommended a multi-verifier setup with redundancy, where consensus across several independent verifiers would be required to confirm a message. Under that configuration, poisoning one verifier's data feed would not have been enough to forge a valid message. "KelpDAO chose to utilize a 1/1 DVN configuration," LayerZero wrote, using the protocol's term for decentralized verifier networks. "A properly hardened configuration would have required consensus across multiple independent DVNs, rendering this attack ineffective even in the event of any single DVN being compromised." LayerZero said it has confirmed zero contagion to any other application on the protocol. Every OFT-standard token and application running multi-verifier setups was unaffected. The LayerZero Labs verifier is back online, and the company said it will no longer sign messages for any application running a 1-of-1 configuration, forcing a protocol-wide migration off single-verifier setups.A protocol-level bug would have implied every OFT token on every chain was potentially at risk. However, a configuration failure by a single integrator, combined with a targeted infrastructure attack, implies the protocol worked as designed and that Kelp's security choices, not LayerZero's code, created the opening. Kelp has not yet publicly responded to LayerZero's framing or addressed why it operated a 1-of-1 verifier setup despite the explicit recommendations against it. Lazarus Group has been linked to the Drift Protocol exploit on April 1 and now Kelp on April 18, meaning the same North Korean unit has drained more than $575 million from DeFi in 18 days through two structurally different attack vectors: social engineering governance signers at Drift and poisoning infrastructure RPCs at Kelp. Breach tied to compromised AI tool may have exposed credentials used by app frontends, the user-facing layer that connects web3 wallets and trading interfaces to backend services.Web infrastructure provider Vercel disclosed a security breach that may have exposed customer API keys, prompting crypto projects to rotate credentials and review their code. Vercel traced the intrusion to a compromised Google Workspace connection via third-party AI tool Context.ai, but said environment variables marked as sensitive are stored in...15 hours ago
United States Latest News, United States Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Kelp DAO exploited for $292 million with wrapped ether stranded across 20 chainsAn attacker drained 116,500 rsETH, roughly 18% of circulating supply, from Kelp's LayerZero-powered bridge on Saturday, triggering emergency freezes across Aave, SparkLend, Fluid and Upshift.
Read more »
Kelp restaking platform exploited, $293M drained in attackThe most recent news about crypto industry at Cointelegraph. Latest news about bitcoin, ethereum, blockchain, mining, cryptocurrency prices and more
Read more »
South Korea says North Korea has launched multiple ballistic missiles toward the North’s watersSouth Korea says North Korea has launched multiple ballistic missiles toward the North’s eastern waters. South Korea’s Joint Chiefs of Staff says the launches happened on Sunday morning from the North’s eastern Sinpo area. It says South Korea has bolstered its surveillance posture and is closely exchanging information with the U.S. and Japan.
Read more »
Massive $290 Million Hack Hits Ethereum and ArbitrumOne of the largest decentralized finance (DeFi) exploits of 2026 took place on Saturday..
Read more »
Aave records $6 billion TVL drop as Kelp hack exposes structural risk at DeFi lenderThe AAVE token fell 16% and deposits fled the protocol after attackers used drained rsETH as collateral to borrow wrapped ether, leaving Aave to quantify how much bad debt it is now carrying.
Read more »
Kelp exploit highlights problem with non-isolated DeFi lending: Crypto execsThe most recent news about crypto industry at Cointelegraph. Latest news about bitcoin, ethereum, blockchain, mining, cryptocurrency prices and more
Read more »