LayerZero reports $292M loss in KelpDAO bridge hack

LayerZero Labs released a detailed incident report on the KelpDAO rsETH bridge exploit that occurred on April 18. Approximately 116,500 rsETH, valued at about $292 million, were stolen after attackers compromised LayerZero's RPC infrastructure and forced the Decentralized Validator Network (DVN) to sign forged cross‑chain messages. The breach was accomplished through a social‑engineering operation that obtained developer session keys, infiltration of internal RPC nodes, and denial‑of‑service attacks that pushed verification to the compromised nodes.

Investigations by multiple security firms point to the North Korea‑linked hacker group TraderTraitor (UNC4899), part of Lazarus Group, as the likely perpetrators. The attack exploited KelpDAO’s single‑validator (1/1 DVN) configuration, which contradicted LayerZero’s recommendation for multi‑DVN redundancy. LayerZero says the incident was confined to KelpDAO’s bridge, with no contagion to other assets or applications.

In response, LayerZero has rebuilt the affected infrastructure using a zero‑trust architecture, mandated minimum security settings for DVN channels, and announced it will no longer sign messages for applications that use a 1/1 validator configuration. The company is cooperating with law‑enforcement agencies and industry partners to trace the stolen funds and strengthen security across its ecosystem.