LayerZero Report on KelpDAO Hack: Confirmed to Only Affect rsETH Pool

BlockBeats News, April 20: LayerZero Labs released an incident report stating that on April 18, KelpDAO was attacked, resulting in a loss of approximately $290 million. The preliminary assessment attributes the attack to the Lazarus Group from North Korea, specifically TraderTraitor. The attack was carried out by poisoning the decentralized validation network (DVN)'s downstream RPC infrastructure. The attacker controlled some RPC nodes, coordinated a DDoS attack, and induced the system to switch to malicious nodes, thus forging cross-chain transactions. The affected RPC nodes have all been taken offline and replaced, and the DVN is now back online.

LayerZero emphasized that this incident was limited to KelpDAO's rsETH application configuration and did not impact other assets or applications. This was because KelpDAO was using a single DVN (1/1) architecture at the time and did not implement the officially recommended redundant multi-DVN mechanism, resulting in a lack of independent validation nodes to identify forged messages. LayerZero stated that its protocol itself did not have vulnerabilities, applications with multi-DVN configurations were not affected, and there is no systemic risk.

LayerZero announced that it will urge all projects using a single DVN configuration to migrate to a multi-DVN architecture as soon as possible. It has also suspended signature and verification services for 1/1 configuration applications. Additionally, the company is cooperating with global law enforcement agencies in the investigation and assisting industry partners in tracking the stolen funds. LayerZero stated that this incident highlights the value of modular security architecture and reminds the industry to pay attention to the potential security risks in RPC validation pathways.