LayerZero Labs Addresses KelpDAO Attack Linked to Lazarus Group

On April 20, LayerZero Labs released a statement regarding an attack on KelpDAO that occurred on April 18, resulting in a loss of approximately $2.9 billion. According to BlockBeats, the attack is believed to have been carried out by the Lazarus Group, specifically TraderTraitor, with ties to North Korea. The attackers compromised the decentralized verification network (DVN) by poisoning the downstream RPC infrastructure, controlling some RPC nodes, and using DDoS attacks to redirect the system to malicious nodes, thereby forging cross-chain transactions. All affected RPC nodes have been taken offline and replaced, and the DVN is now operational again. LayerZero emphasized that the incident was limited to KelpDAO's rsETH application configuration and did not impact other assets or applications. The vulnerability arose because KelpDAO used a single DVN (1/1) architecture, lacking the redundancy of multiple DVNs as officially recommended, which would have provided independent verification nodes to detect forged messages. LayerZero clarified that its protocol did not have any inherent flaws, and applications configured with multiple DVNs were unaffected, indicating no systemic contagion risk. LayerZero announced plans to expedite the migration of all projects using single DVN configurations to a multi-DVN architecture and has suspended signature and verification services for 1/1 configured applications. The company is collaborating with global law enforcement agencies to investigate the incident and assist industry partners in tracking the stolen funds. LayerZero stated that the event highlights the importance of modular security architecture and serves as a reminder to the industry about potential security risks in RPC verification pathways.