LayerZero KelpDAO exploit: $292M rsETH stolen; DVN single point fixed

Published: 2026-05-20 14:03:19 |

LayerZero published its incident report on the KelpDAO rsETH bridge attack, confirming the LayerZero KelpDAO exploit led to about 116,500 rsETH stolen (≈$292M). LayerZero says the issue was confined to KelpDAO’s rsETH deployment, caused by a risky single DVN (1/1) setup where LayerZero Labs acted as the only verifier. LayerZero attributes the breach to compromised off-chain verification infrastructure, not a core LayerZero protocol flaw. Attackers allegedly “poisoned” DVN RPC nodes by accessing the RPC list, compromising two nodes in separate clusters, replacing op-geth binaries, and feeding forged transaction data only to the DVN while returning accurate data elsewhere. A DDoS forced failover onto the poisoned nodes, enabling the DVN to approve messages that never occurred on-chain. Attribution has been tightened: Chainalysis links the activity to North Korea’s Lazarus Group (TraderTraitor). Nexus Mutual estimated the $292M drain occurred in under 46 minutes. LayerZero responded by replacing affected RPC nodes, restoring DVN operations, involving law enforcement/partners (including Seal911), and—most importantly—stopping signing/attesting for any applications using 1/1 DVN configurations while pushing multi-DVN redundancy and independent verifier consensus.

Bearish

This is a direct DeFi hack tied to the rsETH bridge flow: the LayerZero KelpDAO exploit is confirmed at ~112k+ rsETH (~$292M), and the report highlights structural weakness (a 1/1 DVN single point of failure) plus the use of forged data plus DDoS-induced failover. For rsETH traders, that implies elevated counterparty/operational risk and likely near-term redemptions, liquidity stress, and sentiment damage. Even though LayerZero is tightening controls (multi-DVN push, stopping attestation for 1/1 DVN apps, RPC node replacement) and law enforcement tracing is underway, the event’s magnitude and the speed of loss (under 46 minutes) can keep volatility elevated in the short term. Longer term, security upgrades could stabilize confidence, but the immediate market reaction to a confirmed large drain on rsETH is typically negative.