LayerZero: The KelpDAO attack was limited to its rsETH configuration and the protocol itself has no vulnerabilities.

LayerZero Labs announced on the X platform that KelpDAO suffered an attack on April 18th, resulting in losses of approximately $290 million. The initial assessment identifies the attacker as Lazarus Group. The attack was achieved by poisoning the downstream RPC infrastructure upon which KelpDAO's decentralized validator network (DVN) relies. The attackers controlled some RPC nodes and, in conjunction with a DDoS attack, induced the system to switch to malicious nodes, thereby forging cross-chain transactions. Currently, all affected RPC nodes have been taken offline and replaced, and DVN has resumed operation. LayerZero emphasizes that this incident was limited to KelpDAO's rsETH application configuration and did not affect other assets or applications. KelpDAO's use of a single DVN architecture without multi-DVN redundancy mechanisms prevented it from identifying forged messages. The LayerZero protocol itself did not have any vulnerabilities, and applications with multi-DVN configurations were unaffected. LayerZero will drive the migration of all single DVN configuration projects to a multi-DVN architecture and has suspended signing and verification services for 1/1 configuration applications, while assisting law enforcement agencies in tracking stolen funds.