LayerZero Apologizes for Security Oversight in Kelp DAO Exploit

LayerZero has issued an apology for its role in a security oversight that contributed to the April 18 exploit, which resulted in the loss of approximately $292 million from Kelp DAO's rsETH bridge. According to NS3.AI, the incident involved the use of LayerZero's own DVN in a 1/1 setup, which was compromised. The Lazarus Group exploited internal RPC nodes, while an external RPC provider was subjected to a DDoS attack. LayerZero clarified that the underlying protocol remained unaffected. In response, LayerZero announced that its Labs DVN will no longer support 1/1 configurations, and efforts are underway to migrate default pathways to a more secure 5/5 setup where feasible.