LayerZero blames Kelp’s setup for $290 million exploit, attributes it to North Korea’s Lazarus
LayerZero said the attackers compromised two RPC nodes the company’s verifier relied on and DDoS’d the rest, with the attack working only because Kelp had ignored multi-verifier recommendations.
What to know:
- LayerZero blamed the $290 million Kelp DAO exploit on Kelp’s decision to use a single-verifier configuration, despite prior warnings to adopt a multi-verifier setup.
- Attackers, whom LayerZero preliminarily linked to North Korea’s Lazarus Group, compromised two RPC nodes and used a DDoS attack to force failover, tricking LayerZero’s verifier into approving a fraudulent cross-chain transaction.
- LayerZero said the incident stemmed from Kelp’s security choices rather than a protocol-level bug, has found no contagion to other applications, and will no longer sign messages for any project using a 1-of-1 verifier configuration.
Attackers, whom LayerZero attributed with preliminary confidence to North Korea’s Lazarus Group and its TraderTraitor subunit, compromised two of the remote procedure call (RPC) nodes that LayerZero’s verifier relied on to confirm cross-chain transactions.
RPC nodes are the servers that let software read and write data on a blockchain, and LayerZero’s verifier used a mix of internal and external ones for redundancy.
The attackers swapped the binary software running on two of those nodes with malicious versions designed to tell LayerZero’s verifier that a fraudulent transaction had occurred, while continuing to report accurate data to every other system querying those same nodes.
That selective lying was engineered to keep the attack invisible to LayerZero’s own monitoring infrastructure, which queries the same RPCs from different IP addresses.
