Key Highlights
- LayerZero said the $292 million exploit targeted the KelpDAO rsETH bridge through compromised verifier infrastructure.
- A single-verifier OApp configuration enabled the forged cross-chain message to be accepted.
- LayerZero will no longer allow its DVN to operate as the sole signer for channels using its services.
LayerZero Labs has released a post-mortem report on a security breach that resulted in the theft of approximately $292 million from the KelpDAO rsETH bridge.
According to the report, the attack took place on April 18, 2026, and targeted LayerZero’s cross-chain messaging protocol bridge. The company attributed the incident to TraderTraitor, a North Korean state-sponsored threat group also known as UNC4899, citing research from Mandiant, CrowdStrike, and other security firms.
How the attack unfolded
The KelpDAO attack began on March 6, 2026, after the attacker used social engineering on a LayerZero Labs developer to gain session keys. The attacker then used this access to break into the company’s RPC cloud infrastructure, where they were able to breach the company’s Remote Procedure Call (RPC) nodes that store blockchain data.
Once the attacker managed to get into the network, they used sophisticated techniques to patch the memory of RPC, such that LayerZero tools would receive a response as usual, even as they manipulated the responses provided to LayerZero Labs Decentralized Verifier Network (DVN).
In order to guarantee success, the attacker conducted a DoS attack against an external RPC provider such that DVN signing could only use the two internal nodes that were compromised. This manipulation allowed the creation of a valid attestation for a forged cross-chain message.
The attack was enabled through the single-verifier design of the OApp that was compromised. As no additional DVN was needed for validation, the destination smart contract accepted a valid attestation and released the rsETH. Other OApps and channels were not affected.
LayerZero tightens security controls
Following the incident, several changes have been made to the security policies employed by LayerZero Labs. Previously, LayerZero Labs adopted a neutral position on the OApp configurations that could be selected by the application delegates.
This approach will no longer be used. Specifically, the LayerZero Labs DVN will refuse to act as the only signer on any channel while ensuring that at least a minimal level of security configuration exists in all the channels. The underlying protocol itself will remain unchanged.
The company has also completely restructured its cloud infrastructure instead of applying any patches. This new cloud environment has improved hardened baselines, removal of all old credentials, privilege access based on just-in-time principles with time-limited credentials, multi-person approval processes for IAM modifications, and additional validation of devices and sessions.
LayerZero Labs has been closely coordinating with Mandiant, CrowdStrike, and zeroShadow when it comes to forensic analysis, attributing attacks, and monitoring tokens. The company is also coordinating with law enforcement agencies in this regard and states that it has committed to ongoing ecosystem-wide security reviews and hardening efforts.
One of the biggest DeFi attacks
The $292 million hack is among the biggest DeFi hacks of 2026 and highlights the weaknesses that continue to exist with the confluence of social engineering attacks, compromised infrastructure, and poor protocol configuration.
Though the modular nature of the protocol mitigated the impact of the attack, the exploit revealed how just one vulnerable point in the configuration of verifiers can have devastating consequences.
As the investigation goes on and as these funds start being traced, the case has been a clear lesson that nation-state attackers are becoming an increasingly threatening factor in the crypto sector and that security is key to cross-chain projects.
Also Read: Tether Tightens Grip on Twenty One Capital After SoftBank Exit
