LayerZero reports the KelpDAO theft incident, confirming that it only affects the rsETH configuration
LayerZero Labs released an incident report stating that KelpDAO suffered an attack resulting in a loss of approximately $290 million. Preliminary assessments indicate that the attacker is the Lazarus Group, which has ties to North Korea (more specifically, TraderTraitor). The attack was executed by poisoning the downstream RPC infrastructure relied upon by its decentralized verification network (DVN). The attacker controlled some RPC nodes and, in conjunction with a DDoS attack, induced the system to switch to malicious nodes, thereby forging cross-chain transactions.
All affected RPC nodes have been taken offline and replaced, and the DVN has now resumed operation. LayerZero emphasized that this incident was limited to the rsETH application configuration of KelpDAO and did not affect other assets or applications. The reason is that KelpDAO was using a single DVN (1/1) architecture at the time and did not utilize the multi-DVN redundancy mechanism that is officially recommended for long-term use, resulting in a lack of independent verification nodes to identify forged messages.
LayerZero pointed out that there were no vulnerabilities in its protocol itself, and applications with multi-DVN configurations were not affected, meaning there is no contagious risk in the system. LayerZero stated that it will urge all projects using single DVN configurations to migrate to multi-DVN architectures as soon as possible and has suspended providing signature and verification services for 1/1 configuration applications. Meanwhile, the company is cooperating with global law enforcement agencies to investigate and assist industry partners in tracking the stolen funds. LayerZero noted that this incident highlights the value of modular security architecture and also reminds the industry to pay attention to the potential security risks of RPC verification links.
You may also like

Morning News | Michael Saylor stated that this week he bought bonds instead of Bitcoin; StablR was attacked and lost about 2.8 million dollars; the U.S. Congress is pushing the Bitcoin Reserve Act again

SuperEx's Mars exploration dream: Digital currency is the key to unlocking economic exchanges in the interstellar era

Key Takeaways: Full Text of Google Chief Scientist Shanahan's Speech

Agentic Design Patterns: A book that made me rethink "What exactly is an Agent?"

The richest chairman of the Federal Reserve in 112 years has arrived: Kevin Warsh is rewriting the rules

Vitalik talks about the future of the Ethereum Foundation: a smaller, more distinctive, yet more enduring ship

New Types of Information Laundering in Prediction Markets: How Secrets Integrate into Investment Signals

Vitalik emphasized in a post that Ethereum must be "amazing," but the foundation is not the center

DeFi has reached its most dangerous moment: the real vulnerabilities are not in the code

WEEX Bitcoin Pizza Day: Zero Fees, BTC Cashback & 150,000 USDT to Honor Crypto History

a16z: 7 Images to Understand How Tokenization Changes the Nature of Assets

The secret to Hyperliquid's success dismantled from the five-layer financial stack

After Futu Securities was banned, will buying stocks on-chain be the new remedy?
Why Crypto Traders Are Watching Gold and Nasdaq Again in 2026

Why have foreign exchange stablecoins never taken off?

AIDC, computing power leasing, and cloud: The "three-part thesis" of AI transformation in cryptocurrency mining farms

Futu has had all its illegal gains confiscated, reminding cryptocurrency exchanges

