Published 5 months ago • loading... • Updated 5 months ago
LayerZero Ties $292M KelpDAO Hack to North Korea's Lazarus Group
LayerZero said the attackers bypassed the bridge by spoofing RPC data, and Kelp’s single-verifier setup let 116,500 rsETH be drained, it said.
LayerZero Labs attributed the $290 million Kelp DAO exploit to the protocol's security configuration, stating "KelpDAO chose to utilize a 1/1 DVN configuration" despite previous warnings against single-verifier setups.
Attackers, whom LayerZero attributed with preliminary confidence to North Korea's Lazarus Group, compromised two RPC nodes and deployed a DDoS attack to force a failover to poisoned infrastructure.
Once the failover triggered, Kelp's bridge released 116,500 rsETH to the attackers; malicious software then self-destructed, wiping local logs to conceal the manipulation of infrastructure RPCs.
The LayerZero Labs verifier is back online, and the company will no longer sign messages for any application running a 1-of-1 configuration, forcing a protocol-wide migration.
Lazarus Group has been linked to both the Drift Protocol exploit and Kelp, meaning the North Korean unit has drained more than $575 million from DeFi in 18 days through two structurally different attack vectors.